Software developer information security judgment method, system and equipment and medium

Abstract

The invention discloses a software developer information security judgment method, system and device and a medium, and relates to the technical field of software development security management, and the method comprises the steps: obtaining the historical core development behavior data of a developer, and constructing a multi-dimensional behavior feature vector and a development team cooperation relation graph; establishing a personalized behavior baseline model in combination with the role behavior template; calculating an individual risk score based on the behavior data collected in real time; establishing a team risk propagation model to generate a team cooperation risk index; determining a risk level according to the individual risk score and the team cooperation risk index, and executing a response strategy; and collecting evaluation data to optimize the behavior baseline model and the team risk propagation model. According to the method, a complete technical link from historical data analysis to real-time risk monitoring is constructed, the risk identification and early warning capability is improved, dynamic regulation of risk prevention and control is realized through differentiated response of scene perception, and a reliable information security protection scheme is provided for a software development team.

Description

Technical Field

[0001] The present invention relates to the technical field of software development security management, and in particular to a method, system, device and medium for determining information security of software developers. Background Art

[0002] With the continuous evolution of collaborative software development models, developers typically have greater system access rights and data manipulation freedom during the development process. Existing methods for managing software developer information security primarily include technical means such as permission management, operation auditing, and behavior monitoring. Permission management technology uses a role-based access control model to assign appropriate system permissions to developers with different responsibilities. Operation auditing technology records key developer operations and conducts compliance checks. Behavior monitoring technology collects development behavior data, identifies abnormal operations using preset rules or statistical methods, and issues warnings.

[0003] In real-world applications, developers' behavior patterns often exhibit individual characteristics, and traditional monitoring methods based on fixed rules can produce false positives or omissions in certain complex collaborative scenarios. Furthermore, with the prevalence of collaborative models like agile development, the collaborative relationships between team members are becoming increasingly complex, and individual security risks can spread through collaborative networks. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method for determining information security for software developers, which solves technical problems in the prior art such as the need to improve the accuracy of individual risk assessment and the lack of team risk propagation analysis.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for determining information security of software developers, which comprises:

[0008] Obtain historical core development behavior data of developers, construct multi-dimensional behavior feature vectors through feature fusion algorithms, and simultaneously build a multi-dimensional collaboration relationship diagram of the development team;

[0009] Utilize multi-dimensional behavioral feature vectors and combine them with role behavior templates to build a personalized behavioral baseline model for each developer;

[0010] The core development behavior data collected in real time is converted into feature vectors, compared with the behavioral baseline model, and the behavioral deviation is calculated based on situational factors and quantified into individual risk scores;

[0011] Establish a team risk propagation model based on a multi-dimensional collaborative relationship diagram, analyze the propagation path of abnormal behavior in combination with individual risk scores, and generate a team collaboration risk index;

[0012] Establish a dynamic risk threshold judgment mechanism, combine individual risk scores and team collaboration risk index to determine the risk level, and implement corresponding security response strategies based on the risk level;

[0013] Collect evaluation data for security response strategies and optimize behavioral baseline models and team risk propagation models.

[0014] As a preferred solution of the software developer information security judgment method of the present invention, the multi-dimensional collaboration relationship diagram of the development team is constructed, including:

[0015] Extract team collaboration data from historical core development behavior data and perform normalization;

[0016] Quantify collaboration relationship parameters based on team collaboration data, build a collaboration intensity quantification model, and generate a collaboration intensity matrix among developers;

[0017] A multi-dimensional collaboration relationship graph is constructed based on the collaboration intensity matrix. The basic graph structure is established with developers as nodes and collaboration intensity as edge weights, and sub-graph mappings are generated for project and technology stack dimensions.

[0018] Perform topological analysis on the multi-dimensional collaboration relationship graph and identify core collaboration groups, bridge nodes and abnormal collaboration patterns through graph analysis algorithms.

[0019] As a preferred solution of the software developer information security judgment method of the present invention, the personalized behavior baseline model is established for each developer in combination with the role behavior template, including:

[0020] Build a role behavior template library based on the work characteristics of developers;

[0021] Perform hierarchical time window analysis on multi-dimensional behavioral feature vectors to extract developer behavior patterns at different time scales;

[0022] Statistical analysis methods are used to process behavioral patterns and generate behavioral baseline parameters;

[0023] Combine the role behavior template library and behavior baseline parameters to build a personalized behavior baseline model for each developer;

[0024] Dynamically adjust behavioral baseline parameters based on model update trigger conditions.

[0025] As a preferred solution of the information security judgment method for software developers of the present invention, the calculation of the behavioral deviation degree in combination with situational factors and quantification into a personal risk score includes:

[0026] Process the real-time core development behavior data to generate a real-time behavior feature vector that is consistent with the dimensions of the personalized behavior baseline model;

[0027] A multi-level deviation calculation method is used to calculate the deviation between the real-time behavior feature vector and the personalized behavior baseline model, generating the behavior deviation vector for each dimension.

[0028] Obtain the context factor parameters of the current development environment and calculate the context adjustment coefficient;

[0029] Combining the behavioral deviation vector and the situational adjustment coefficient, the weighted deviation is calculated and converted into an individual risk score;

[0030] Conduct time series analysis on individual risk scores over continuous time periods to identify risk change trends and abnormal fluctuations, and output standardized risk assessment data.

[0031] As a preferred solution of the information security judgment method for software developers of the present invention, the team risk propagation model is established based on the multi-dimensional collaboration relationship diagram, including:

[0032] Map individual risk scores to developer nodes in a multidimensional collaboration graph to determine a set of risk nodes;

[0033] Based on the risk node set, the propagation paths in the multidimensional collaboration relationship graph are obtained, and the propagation paths are divided into intra-group propagation paths and cross-group propagation paths according to the core collaboration groups and bridge nodes.

[0034] Based on the collaboration strength values ​​of the corresponding node pairs in the collaboration strength matrix and the authority risk coefficient of the nodes, the propagation probability baseline value of the propagation path is calculated;

[0035] The propagation probability of the propagation path is modified in combination with the attenuation coefficient to generate a risk propagation probability matrix;

[0036] Calculate the cumulative risk value of the developer node based on the risk score of the risk node set and the risk propagation probability matrix;

[0037] The weight coefficient is determined according to the network topology characteristics of the developer's node, and the team collaboration risk index is obtained by weighted calculation of the risk accumulation value.

[0038] As a preferred solution of the information security judgment method for software developers of the present invention, establishing a dynamic risk threshold judgment mechanism includes:

[0039] A two-dimensional risk assessment coordinate system is constructed with individual risk score as the horizontal axis and team collaboration risk index as the vertical axis;

[0040] Calculate the judgment threshold parameters for each risk level based on the distribution characteristics of historical risk data in the risk assessment coordinate system;

[0041] The judgment threshold parameters are used to define the risk level area boundaries in the risk assessment coordinate system to form risk level determination rules;

[0042] The calculated individual risk score and teamwork risk index are used as coordinate points, and the risk area to which they belong is determined according to the risk level determination rules, and the corresponding risk level is output;

[0043] Trigger a security response strategy of corresponding strength based on the risk level matching results.

[0044] As a preferred solution of the software developer information security judgment method of the present invention, wherein:

[0045] Optimizing the behavioral baseline model and team risk propagation model includes:

[0046] Build models to optimize datasets;

[0047] Build an intelligent training sample screening mechanism to evaluate the value of model optimization data sets and screen model training samples;

[0048] Based on the analysis results, the parameters of the behavioral baseline model and the team risk propagation model are tuned and the structure is optimized;

[0049] Establish a model optimization effect verification mechanism and decide whether to apply the optimized model parameters based on the verification results.

[0050] In a second aspect, the present invention provides a software developer information security judgment system, comprising:

[0051] The data acquisition module is used to obtain historical core development behavior data of developers, construct multi-dimensional behavior feature vectors through feature fusion algorithms, and simultaneously construct a multi-dimensional collaboration relationship diagram of the development team;

[0052] A baseline model building module is used to build a personalized behavior baseline model for each developer by using multi-dimensional behavior feature vectors and combining them with role behavior templates.

[0053] The personal risk assessment module converts the core development behavior data collected in real time into feature vectors, compares them with the behavioral baseline model, calculates the behavioral deviation based on situational factors, and quantifies it into a personal risk score;

[0054] The team risk assessment module is used to establish a team risk propagation model based on a multi-dimensional collaboration relationship diagram, analyze the propagation path of abnormal behavior in combination with individual risk scores, and generate a team collaboration risk index;

[0055] The security response execution module is used to establish a dynamic risk threshold judgment mechanism, determine the risk level based on the individual risk score and team collaboration risk index, and execute the corresponding security response strategy according to the risk level;

[0056] The model optimization and update module is used to collect evaluation data for security response strategies and optimize the behavioral baseline model and team risk propagation model based on data analysis.

[0057] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the software developer information security judgment method of the first aspect of the present invention is implemented.

[0058] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the software developer information security judgment method of the first aspect of the present invention is implemented.

[0059] The beneficial effects of the present invention are as follows: the present invention realizes the systematic mapping from individual behavior to team collaboration network through the construction of multi-dimensional behavioral feature vectors and collaboration relationship diagrams; establishes an accurate conversion mechanism from behavioral characteristics to risk assessment through the combination of role templates and personalized baselines; reveals the diffusion law of risks under different collaboration modes through the risk propagation model of group structure and bridge nodes; forms a data-driven dynamic threshold determination mechanism through the two-dimensional evaluation of individual risk and team risk; and ensures the continuous improvement of prevention and control effects through closed-loop optimization of evaluation feedback. The present invention constructs a complete technical chain from historical data analysis to real-time risk monitoring, while improving risk identification and early warning capabilities, and realizes dynamic adjustment of risk prevention and control through differentiated response of scenario perception, providing software development teams with a reliable information security protection solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1 Flowchart of the information security judgment method for software developers.

[0062] Figure 2 Construct a flow chart for the multi-dimensional collaborative relationship diagram of the information security judgment method of software developers.

[0063] Figure 3Flowchart for calculating personal risk scores for software developers' information security judgment method.

[0064] Figure 4 Schematic diagram of the functional modules of the information security judgment system for software developers. DETAILED DESCRIPTION

[0065] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0066] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0067] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0068] Reference Figures 1 to 4 , is an embodiment of the present invention, which provides a method for determining information security of software developers, as shown in the flow chart. Figure 1 As shown, the following steps are included:

[0069] S1: Obtain historical core development behavior data of developers, construct a multi-dimensional behavior feature vector through feature fusion algorithm, and simultaneously construct a multi-dimensional collaboration relationship diagram of the development team.

[0070] Core development behavior data includes code submission data, project participation data, and team collaboration data. Code submission data, including submission frequency and code volume, is collected through the version control system; project participation data, including task completion status and project roles, is collected through the project management system; and team collaboration data, including review records and discussion participation, is collected through the collaboration platform. After data acquisition, it is cleaned, deduplicated, standardized, and sensitive information is desensitized to ensure data quality and privacy.

[0071] Furthermore, the feature data of the three dimensions of code behavior, project participation and team collaboration are normalized, and the features of different dimensions are integrated into a unified multi-dimensional vector representation through a weighted fusion strategy to form a comprehensive behavioral feature portrait of each developer.

[0072] Furthermore, the multi-dimensional collaborative relationship diagram constructs a flow chart such as Figure 2As shown in the figure, the overall team collaboration data is extracted from the historical core development behavior data of all developers and standardized. The team collaboration data includes code submission association records, task collaboration time series data, communication interaction frequency statistics and permission sharing relationship tables; based on the team collaboration data, the collaboration relationship parameters are quantified. The collaboration relationship parameters include collaboration frequency, collaboration duration and collaboration depth. The collaboration depth is quantified by the number of jointly modified files, the number of review interactions and the depth of technical discussions; a collaboration intensity quantification model is constructed, and the collaboration intensity matrix between developers is generated by weighted integration of the above collaboration relationship parameters.

[0073] Furthermore, a multidimensional collaboration relationship graph is constructed based on the collaboration intensity matrix, and a basic graph structure is established with developers as nodes and collaboration intensity as edge weights. Subgraph mappings of project dimensions and technology stack dimensions are generated according to the projects in which developers participate and the technology stacks used. Topological analysis is performed on the multidimensional collaboration relationship graph, and core collaboration groups, bridge nodes and abnormal collaboration patterns are identified through graph analysis algorithms, including the following steps: preprocessing the multidimensional collaboration relationship graph, including graph structure verification, weight normalization and noise data filtering; using a community discovery algorithm to identify core collaboration groups, and dividing the set of closely collaborating developers through a modularity optimization method; calculating node importance based on betweenness centrality and closeness centrality indicators, and identifying bridge nodes and key connectors in the team; analyzing collaboration patterns through anomaly detection algorithms, and identifying abnormal collaboration patterns and potential risk nodes that deviate from normal collaboration behaviors. Abnormal collaboration patterns include abnormally high-frequency collaboration, abnormal cross-group collaboration, and abnormal authority sharing patterns.

[0074] Furthermore, a collaborative relationship graph update mechanism is established, triggering incremental updates based on collaboration pattern change thresholds. This collaboration pattern change threshold uses a multi-metric judgment mechanism, including the rate of change in collaboration intensity, changes in node connectivity, and group structure stability. Graph updates are triggered by setting percentage change thresholds and statistical intervals for each dimension.

[0075] Optimally, the multidimensional behavioral feature vectors and multidimensional collaborative relationship graphs constructed through feature fusion algorithms enable a systematic mapping of development behavior data to collaborative network structures. This approach not only considers the multidimensional representation of individual behavioral characteristics but also depicts the dynamic nature of team collaboration through a graph structure, improving feature dimension coverage and the accuracy of collaborative relationship identification, providing a more complete data foundation for subsequent risk analysis.

[0076] S2: Use multi-dimensional behavioral feature vectors and role behavior templates to establish a personalized behavioral baseline model for each developer.

[0077] Specifically, step S2 includes the following steps:

[0078] S2.1: Build a role behavior template library based on the work characteristics of developers.

[0079] In this embodiment, a role behavior template library is established based on the typical division of labor within a development team. This includes templates for core developers, senior developers, and technical managers. Each role behavior template contains typical behavioral characteristics across three dimensions: code submission, project participation, and team collaboration. Based on the differences in role characteristics, corresponding behavioral characteristic weight coefficients are assigned to each role behavior template across the three dimensions of code submission frequency, project participation breadth, and team collaboration intensity.

[0080] S2.2: Perform hierarchical time window analysis on the multi-dimensional behavioral feature vector to extract the developer's behavior patterns at different time scales.

[0081] In this example, a three-tiered time window architecture is employed, encompassing daily behavior cycles, weekly work patterns, and project cycle behaviors. Within each time window, three core behavioral patterns are extracted: code submission patterns, project participation patterns, and team collaboration patterns. This generates a behavioral pattern dataset categorized by time window. This layered time window analysis mechanism effectively captures the periodicity and regularity of development behavior across different time dimensions.

[0082] S2.3: Use statistical analysis methods to process behavioral patterns and generate behavioral baseline parameters.

[0083] Specifically, statistical analysis is performed on the behavioral patterns of each time window output by S2.2, and the statistical characteristic values ​​of each behavioral pattern are calculated to generate a code submission frequency baseline, a project participation pattern baseline, and a team collaboration intensity baseline. Each baseline parameter corresponds to the statistical results of the behavioral pattern of the corresponding time window.

[0084] S2.4: Combine the role behavior template library and behavior baseline parameters to build a personalized behavior baseline model for each developer.

[0085] Specifically, the matching degree between the developer's multi-dimensional behavioral feature vector and each template in the role behavior template library is calculated to determine the role affiliation of each developer; based on the role affiliation, the behavioral baseline parameters are weightedly adjusted using the behavioral feature weight coefficient of the corresponding role behavior template to generate role-customized baseline parameters; based on the developer's personal historical behavioral statistical characteristics, the role-customized baseline parameters are personalized fine-tuned to generate a personalized behavior baseline model.

[0086] S2.5: Establish an adaptive update mechanism for the personalized behavior baseline model and dynamically adjust the behavior baseline parameters based on the model update trigger conditions.

[0087] In this embodiment, the trigger condition for model updates includes the cumulative amount of newly added core development behavior data reaching the baseline update threshold. The baseline update threshold is determined dynamically using a multi-level strategy: Initial threshold values ​​are set based on the typical behavior frequencies of different role types, and then personalized adjustments are made based on individual behavior stability coefficients and environmental change perception factors.

[0088] Preferably, through the combination of role behavior template matching and personalized fine-tuning, the established behavior baseline model can reflect the common characteristics of the role and individual characteristics, and realize the construction from multi-dimensional behavior feature vector to personalized baseline model, effectively improving the baseline model's fit to individual behavior, enhancing the accuracy of abnormal behavior identification, shortening the baseline update response time, and enabling the behavior baseline model to dynamically adapt to the evolution of individual work modes.

[0089] S3: Convert the core development behavior data collected in real time into feature vectors, compare them with the behavioral baseline model, calculate the behavioral deviation based on situational factors, and quantify it into an individual risk score.

[0090] Specifically, the personal risk score calculation flow chart is as follows: Figure 3 As shown, the following steps are included:

[0091] S3.1: Use feature fusion algorithm to process real-time core development behavior data to generate real-time behavior feature vectors that are consistent with the dimensions of the personalized behavior baseline model.

[0092] S3.2: Use a multi-level deviation calculation method to calculate the deviation between the real-time behavior feature vector and the personalized behavior baseline model, and generate the behavior deviation vector of each dimension.

[0093] The multi-level deviation calculation involves numerical deviation analysis and behavioral pattern matching analysis. Numerical deviation analysis involves calculating the statistical deviation of the characteristic values ​​of each dimension, while behavioral pattern matching analysis involves calculating behavioral pattern matching coefficients at different time scales. The statistical deviation and pattern matching coefficients are combined and weighted using the weights of the character's behavioral characteristics to generate a standardized behavioral deviation vector.

[0094] Preferably, by combining numerical deviation analysis with behavioral pattern matching analysis, a unified multi-dimensional deviation calculation framework is formed, which helps to improve the effect of behavioral anomaly detection.

[0095] S3.3: Obtain the context factor parameters of the current development environment and calculate the context adjustment coefficient.

[0096] The contextual factor parameters include project development status, team collaboration status, and system operation status. The contextual adjustment coefficient is generated by quantitatively analyzing and weighting each state parameter.

[0097] S3.4: Combine the behavioral deviation vector and the situational adjustment coefficient to calculate the weighted deviation and convert it into an individual risk score.

[0098] Specifically, the deviation values ​​of each dimension in the behavioral deviation vector are weighted and integrated to obtain a basic comprehensive deviation. This is then adjusted and calculated using the contextual adjustment coefficient to obtain the final weighted deviation. A standardized mapping function is used to convert the weighted deviation into an individual risk score between 0 and 100, where a higher score indicates a higher degree of risk. By introducing the contextual adjustment coefficient to modify the behavioral deviation, the risk score can be dynamically adjusted based on the development environment, enhancing the environmental adaptability of risk assessment.

[0099] S3.5: Perform time series analysis on individual risk scores over consecutive time periods to identify risk trends and abnormal fluctuations.

[0100] Furthermore, individual risk score sequences within a continuous time window are collected, and sliding window statistical analysis methods are used to calculate the time series characteristic parameters of the risk scores, such as the mean, variance, and rate of change. Based on these time series characteristic parameters, risk trend judgment rules are established to identify rising and falling risk trends and stable states. An abnormal fluctuation detection threshold is set to identify abnormal fluctuation events by comparing the degree of deviation between the current risk score and the historical score distribution. Combining the risk change trend and abnormal fluctuation detection results, a risk change characteristic description is generated, including trend identification, fluctuation degree, and duration. Tracking risk change trends through the time series analysis mechanism enables continuous monitoring of risk assessment.

[0101] S3.6: Output standardized risk assessment data.

[0102] Among them, standardized risk assessment data includes personal risk scores, behavioral deviation vectors and risk change characteristic descriptions.

[0103] Optimally, a comprehensive personal risk assessment system has been established through the integration of multi-level deviation calculation, contextual adjustment, and time-series analysis. This solution simultaneously considers both numerical deviation and behavioral pattern matching, dynamically adjusts to environmental context, and continuously monitors risk trends through time-series analysis. This makes risk assessment more comprehensive and adaptable to the environment, reduces false positives and false negatives, and effectively enhances the real-time and accuracy of risk assessments.

[0104] S4: Establish a team risk propagation model based on the multidimensional collaboration relationship diagram, analyze the abnormal behavior propagation path in combination with individual risk scores, and generate a team collaboration risk index.

[0105] Specifically, step S4 includes the following steps:

[0106] S4.1: Map individual risk scores to developer nodes in a multidimensional collaboration graph, and determine a set of risk nodes based on a preset risk threshold.

[0107] Among them, the preset risk threshold can be determined based on the statistical distribution of historical risk data and used to screen developer nodes with significant risks.

[0108] S4.2: Based on the risk node set, the propagation path in the multidimensional collaboration relationship graph is obtained, and the propagation path is divided into intra-group propagation path and cross-group propagation path according to the core collaboration group and the bridge node.

[0109] Specifically, adjacent nodes of the risk node set are extracted from the multidimensional collaboration relationship graph, and effective propagation edges are screened based on the collaboration strength threshold to construct a risk propagation subgraph, where the collaboration strength threshold is determined by statistical analysis of the collaboration strength matrix; the risk node set is subjected to group affiliation analysis using the identified core collaboration group information to determine the core collaboration group to which each risk node belongs; all reachable paths starting from the risk node are searched in the risk propagation subgraph based on the graph traversal algorithm, and effective propagation paths are screened according to the path length limit and collaboration strength attenuation rule; the effective propagation paths are marked with group attributes, and the paths whose starting and end points are both in the same core collaboration group are marked as intra-group propagation paths; the paths connecting different core collaboration groups through bridge nodes are marked as cross-group propagation paths using the identified bridge node information; the intra-group propagation paths are classified and stored according to the collaboration groups, and the cross-group propagation paths are classified and stored according to the bridge nodes and the connected group pairs, to generate a structured propagation path set.

[0110] Preferably, by dividing the propagation path into intra-group propagation path and cross-group propagation path, the diffusion characteristics of risks under different collaboration modes can be more accurately reflected, effectively improving the timeliness of risk propagation warning and the accuracy of management and control.

[0111] S4.3: Based on the collaboration strength values ​​of the corresponding node pairs in the collaboration strength matrix and the authority risk coefficient of the nodes, the propagation probability baseline value of the propagation path is calculated.

[0112] Furthermore, the collaboration strength values ​​of adjacent node pairs along the propagation path are extracted from the collaboration strength matrix to establish a path-collaboration strength dataset. The permission risk coefficient of each node is calculated based on the developer's system permission level, code access scope, and key resource operation permissions. For both intra-group and inter-group propagation paths, the collaboration strength values ​​of all adjacent node pairs along the path are geometrically averaged to obtain the path collaboration strength value. The permission risk coefficients of the starting and ending nodes of the propagation path are extracted and calculated using the arithmetic average method to obtain the path permission risk adjustment coefficient. The path collaboration strength value is multiplied by the path permission risk adjustment coefficient and normalized to obtain the baseline propagation probability value for the propagation path. By combining collaboration strength and permission risk factors, the propagation probability calculation is more closely aligned with the actual risk propagation characteristics, improving the rationality of risk propagation assessment.

[0113] S4.4: Modify the propagation probability of the propagation path based on the attenuation coefficient to generate a risk propagation probability matrix.

[0114] Furthermore, the distance attenuation coefficient is calculated based on the propagation path length, and the baseline propagation probability value of the cross-group propagation path is corrected for distance attenuation. Bridging attenuation correction is also applied to the cross-group propagation path based on the connectivity coefficient of the bridging node. The corrected propagation probability values ​​are then entered into the risk propagation probability matrix based on the correspondence between the starting and ending nodes, generating a complete team risk propagation probability matrix. By introducing the dual correction mechanisms of distance attenuation and bridging attenuation, the calculation of risk propagation probability is more consistent with actual propagation patterns, enhancing the reliability of risk propagation predictions.

[0115] S4.5: Calculate the cumulative risk value of the developer node based on the risk score of the risk node set and the risk propagation probability matrix.

[0116] Specifically, the risk score of each risk node is multiplied by the corresponding propagation probability and then added up to obtain the cumulative risk value of the node, which represents the comprehensive risk level that the node bears in the collaborative network.

[0117] S4.6: Determine the weight coefficient based on the network topology characteristics of the developer node, and perform weighted calculation on the risk accumulation value to obtain the team collaboration risk index.

[0118] In this embodiment, the network topology characteristics of the developer nodes in the multidimensional collaboration relationship graph are first analyzed, including the node's degree centrality, betweenness centrality, and connectivity. Then, the node's weight coefficient is calculated based on these characteristics. Finally, the weight coefficient is multiplied by the risk accumulation value and normalized to obtain the final team collaboration risk index.

[0119] Optimally, this invention achieves a systematic analysis of risk propagation mechanisms by constructing a team risk propagation model based on a multidimensional collaborative relationship graph. Firstly, it deeply integrates individual risk with collaborative networks, characterizing the propagation characteristics of risk under different collaborative modes through group structure and bridging relationships. Secondly, multidimensional calculations based on collaboration intensity, authority levels, and network topology characteristics enable a quantitative conversion from individual anomalies to team risk. This model improves the accuracy of risk propagation path predictions, reduces the error in propagation speed assessments, and effectively enhances the ability to predict team risk propagation.

[0120] S5: Establish a dynamic risk threshold judgment mechanism, determine the risk level based on the individual risk score and team collaboration risk index, and implement corresponding security response strategies based on the risk level.

[0121] Specifically, step S5 includes the following steps:

[0122] S5.1: Construct a two-dimensional risk assessment coordinate system with individual risk score as the horizontal axis and team collaboration risk index as the vertical axis.

[0123] Specifically, by establishing a two-dimensional coordinate system to spatially map the individual risk score and team collaboration risk index, a two-dimensional representation of the developer's risk status is achieved.

[0124] S5.2: Based on the distribution characteristics of historical risk data in the risk assessment coordinate system, calculate the judgment threshold parameters for each risk level.

[0125] Specifically, historical risk event data is collected, and risk events are classified and labeled according to the severity of the events and the scope of impact; the personal risk scores and team collaboration risk indexes corresponding to historical risk events are mapped to the risk assessment coordinate system to form a set of labeled sample points; the cluster analysis algorithm is used to analyze the set of labeled sample points to identify the data distribution areas and boundary characteristics of different risk levels.

[0126] Furthermore, based on statistical analysis methods, the distribution parameters of each risk level area are calculated, including the center point coordinates, distribution variance and boundary distance parameters; combined with the safety margin requirements between risk levels, the judgment threshold parameters are calculated, including the safety threshold, attention threshold, warning threshold and danger threshold.

[0127] Optionally, a dynamic update mechanism for threshold parameters can be established to periodically recalculate judgment threshold parameters based on changes in the distribution of newly added risk data. Through statistical modeling of historical risk data and dynamic updating of threshold parameters, the risk level determination criteria can adapt to dynamic changes in risk distribution, enhancing the environmental adaptability of risk assessment.

[0128] S5.3: Use the judgment threshold parameters to define the risk level area boundaries in the risk assessment coordinate system and form risk level determination rules.

[0129] Furthermore, based on the calculated judgment threshold parameters, contour lines are drawn in the risk assessment coordinate system. A geometric segmentation algorithm is used to divide the coordinate system space into four risk level regions based on the contour lines. The region boundaries are smoothed based on the distribution parameters of each risk level region. A region identification mapping table is established, associating the safe, attention, warning, and danger areas in the coordinate system space with the corresponding risk level codes. A risk level determination rule configuration file is generated, containing the region boundary coordinate parameters, determination logic, and boundary processing strategy. Through geometric segmentation and boundary smoothing, sudden changes and overlaps in region boundaries are effectively eliminated, making the risk level division clearer and more reasonable.

[0130] Optionally, based on a dynamic update mechanism of threshold parameters, risk level area boundaries are adjusted synchronously to ensure the timeliness of risk level determination rules.

[0131] S5.4: Use the calculated individual risk score and teamwork risk index as coordinate points, determine the risk area according to the risk level determination rules, and output the corresponding risk level.

[0132] Furthermore, the currently calculated personal risk score and teamwork risk index are obtained to construct a two-dimensional coordinate point; the risk level determination rule configuration file is called; the point-in-polygon judgment algorithm is used to determine the preliminary position attribution of the coordinate point in the risk assessment coordinate system; the shortest distance from the coordinate point to the boundary of each risk level area is calculated to identify the critical state of the boundary; when the shortest distance from the coordinate point to the area boundary is less than the preset boundary buffer threshold, the smoothing mechanism is started, and a weighted average algorithm is used to perform fuzzy judgment in combination with the risk level of the adjacent area; based on the smoothing result or the direct area attribution result, a standardized risk level identifier is output, and the coordinate point position and judgment confidence are recorded at the same time; the risk level judgment result is stored together with the timestamp and coordinate parameters.

[0133] Preferably, by introducing a boundary buffer mechanism and a smoothing algorithm, the problem of determining the critical state of the boundary is effectively solved, and the stability of risk level matching is improved.

[0134] S5.5: Trigger a security response strategy of corresponding strength based on the risk level matching results.

[0135] For example, differentiated response measures are taken for different risk levels: the security level maintains the standard monitoring frequency and baseline update strategy; the attention level increases the monitoring frequency, strengthens behavioral trajectory recording, tracks code submission permission usage and file access operations, and sends reminders to security administrators to keep developers unaware of their work; the warning level performs immediate permission verification, implements secondary confirmation for sensitive operations, restricts automatic approval of new permission applications, requires mandatory peer review for code submissions, and promptly notifies direct supervisors and security teams; the danger level adopts a graded blocking mechanism, distinguishing between soft blocking and hard blocking, where soft blocking restricts sensitive operations but retains basic development permissions, and hard blocking completely restricts system access, and immediately initiates manual intervention processes and security incident investigation procedures.

[0136] In addition, the response strategy supports scenario awareness and dynamic adjustment, and sets up an emergency response mechanism. Specifically, through context awareness capabilities, it distinguishes between working hours and non-working hours scenarios, considers the urgency of the project, and identifies the different situations of team collaboration and individual operations. At the same time, it dynamically adjusts to achieve personalized processing based on the developer's historical cooperation, project importance, and the overall risk status of the team. It also provides an emergency application channel that requires multiple approvals and supports temporary unblocking with limited time and full monitoring. Through differentiated response strategies and scenario-aware adjustments, the pertinence and applicability of security responses are improved.

[0137] Optimally, this invention achieves dynamic risk assessment and differentiated responses by constructing a dual-dimensional assessment system for individual risk and teamwork risk. On the one hand, individual risk scores are spatially mapped with teamwork risk indices, enabling risk grading through historical data-driven thresholds. On the other hand, differentiated response strategies and scenario-aware adjustments based on risk levels establish a multi-level response mechanism, enhancing risk management while ensuring development efficiency. This solution improves the accuracy of risk level assessment and the matching of response strategies, shortening the time it takes to resolve risk events.

[0138] S6: Collect evaluation data for security response strategies and optimize the behavioral baseline model and team risk propagation model based on data analysis.

[0139] Specifically, step S6 includes the following steps:

[0140] S6.1: Collect evaluation data for security response strategies, perform data quality checks, and generate model optimization datasets.

[0141] Evaluation data includes execution effectiveness data and manual review feedback data; execution effectiveness data includes response strategy execution, processing result statistics, and system performance indicators; manual review feedback data includes security managers' risk assessment confirmation, abnormal behavior assessment feedback, and response measure rationality evaluation. In addition, data quality verification includes data integrity and consistency verification.

[0142] S6.2: Analyze and organize the model optimization dataset to extract the basis for model tuning.

[0143] Among them, based on the comparative analysis of execution effect data and manual review feedback data, the model judgment deviation is identified, and the parameters that need to be optimized and the adjustment direction are determined.

[0144] S6.3: Based on the analysis results, perform parameter tuning and structural optimization on the behavioral baseline model and team risk propagation model.

[0145] In this embodiment, the thresholds of the role behavior template matching rules and the behavior baseline parameters of the behavior baseline model are adjusted, and the collaborative relationship weights and the risk propagation probability calculation method of the team risk propagation model are revised.

[0146] S6.4: Establish a model optimization effect verification mechanism, confirm the model optimization effect through comparative testing, and decide whether to apply the optimized model parameters based on the verification results.

[0147] This embodiment also provides a software developer information security judgment system, the functional module diagram is as follows Figure 4 Shown, including:

[0148] The data acquisition module is used to obtain historical core development behavior data of developers, construct multi-dimensional behavior feature vectors through feature fusion algorithms, and simultaneously construct a multi-dimensional collaboration relationship diagram of the development team;

[0149] A baseline model building module is used to build a personalized behavior baseline model for each developer by using multi-dimensional behavior feature vectors and combining them with role behavior templates.

[0150] The personal risk assessment module converts the core development behavior data collected in real time into feature vectors, compares them with the behavioral baseline model, calculates the behavioral deviation based on situational factors, and quantifies it into a personal risk score;

[0151] The team risk assessment module is used to establish a team risk propagation model based on a multi-dimensional collaboration relationship diagram, analyze the propagation path of abnormal behavior in combination with individual risk scores, and generate a team collaboration risk index;

[0152] The security response execution module is used to establish a dynamic risk threshold judgment mechanism, determine the risk level based on the individual risk score and team collaboration risk index, and execute the corresponding security response strategy according to the risk level;

[0153] The model optimization and update module is used to collect execution effect data of security response strategies and manual review feedback data, and optimize the behavioral baseline model and team risk propagation model based on data analysis.

[0154] This embodiment also provides a computer device suitable for the software developer information security judgment method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the software developer information security judgment method proposed in the above embodiment.

[0155] The computer device may be a terminal, comprising a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a button, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0156] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for determining information security for software developers proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0157] In summary, the present invention realizes the systematic mapping from individual behavior to team collaboration network through the construction of multi-dimensional behavioral feature vectors and collaborative relationship diagrams; establishes an accurate conversion mechanism from behavioral characteristics to risk assessment through the combination of role templates and personalized baselines; reveals the diffusion law of risks under different collaboration modes through the risk propagation model of group structure and bridge nodes; forms a data-driven dynamic threshold judgment mechanism through the two-dimensional evaluation of individual risk and team risk; and ensures the continuous improvement of prevention and control effects through closed-loop optimization of evaluation feedback. The present invention constructs a complete technical chain from historical data analysis to real-time risk monitoring, and while improving risk identification and early warning capabilities, it realizes dynamic adjustment of risk prevention and control through differentiated response of scenario perception, providing software development teams with a reliable information security protection solution.

[0158] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for determining information security for software developers, characterized by: include, Obtain historical core development behavior data of developers, construct multi-dimensional behavior feature vectors through feature fusion algorithms, and simultaneously build a multi-dimensional collaboration relationship diagram of the development team; Utilizing the multi-dimensional behavioral feature vector and combining it with the role behavior template, a personalized behavioral baseline model is established for each developer; The core development behavior data collected in real time is converted into a feature vector, compared with the behavioral baseline model, and the behavioral deviation is calculated based on the situational factors and quantified into an individual risk score; Establishing a team risk propagation model based on the multi-dimensional collaboration relationship diagram, analyzing the abnormal behavior propagation path in combination with the individual risk score, and generating a team collaboration risk index; Establish a dynamic risk threshold judgment mechanism, combine the individual risk score and the team collaboration risk index to determine the risk level, and implement corresponding security response strategies based on the risk level; Evaluation data of the security response strategy is collected to optimize the behavioral baseline model and the team risk propagation model.

2. The software developer information security determination method according to claim 1, wherein: The multi-dimensional collaboration relationship diagram of the development team is constructed as follows: Extract team collaboration data from historical core development behavior data and perform normalization; Quantify collaboration relationship parameters based on team collaboration data, build a collaboration intensity quantification model, and generate a collaboration intensity matrix among developers; Construct a multidimensional collaboration relationship graph based on the collaboration intensity matrix, establish a basic graph structure with developers as nodes and collaboration intensity as edge weights, and generate subgraph mappings of project dimensions and technology stack dimensions; A topological analysis is performed on the multi-dimensional collaboration relationship graph, and a core collaboration group, a bridge node, and an abnormal collaboration pattern are identified through a graph analysis algorithm.

3. The software developer information security determination method according to claim 1, wherein: The process of establishing a personalized behavior baseline model for each developer by combining the role behavior template includes: Build a role behavior template library based on the work characteristics of developers; Perform hierarchical time window analysis on multi-dimensional behavioral feature vectors to extract developer behavior patterns at different time scales; Processing the behavioral pattern using statistical analysis methods to generate behavioral baseline parameters; Combining the role behavior template library and the behavior baseline parameters, building a personalized behavior baseline model for each developer; The behavior baseline parameters are dynamically adjusted based on a model update trigger condition.

4. The software developer information security determination method according to claim 1, wherein: The calculation of behavioral deviations in combination with situational factors and quantification into individual risk scores includes: Process the real-time core development behavior data to generate a real-time behavior feature vector that is consistent with the dimensions of the personalized behavior baseline model; A multi-level deviation calculation method is used to calculate the deviation between the real-time behavior feature vector and the personalized behavior baseline model, and generate a behavior deviation vector for each dimension; Obtain the context factor parameters of the current development environment and calculate the context adjustment coefficient; Combining the behavioral deviation vector and the situation adjustment coefficient, calculating a weighted deviation and converting it into a personal risk score; Conduct time series analysis on individual risk scores over continuous time periods to identify risk change trends and abnormal fluctuations, and output standardized risk assessment data.

5. The software developer information security determination method according to claim 1, wherein: The establishing of the team risk propagation model based on the multi-dimensional collaboration relationship diagram includes: Mapping the individual risk score to the developer node of the multi-dimensional collaboration relationship graph to determine a risk node set; Acquire a propagation path in the multidimensional collaboration relationship graph based on the risk node set, and divide the propagation path into an intra-group propagation path and an inter-group propagation path according to the core collaboration group and the bridge node; Based on the collaboration strength values ​​of the corresponding node pairs in the collaboration strength matrix and the authority risk coefficient of the nodes, the propagation probability baseline value of the propagation path is calculated; The propagation probability of the propagation path is modified in combination with the attenuation coefficient to generate a risk propagation probability matrix; Calculate the cumulative risk value of the developer node based on the risk score of the risk node set and the risk propagation probability matrix; The weight coefficient is determined according to the network topology characteristics of the developer's node, and the team collaboration risk index is obtained by weighted calculation of the risk accumulation value.

6. The software developer information security determination method according to claim 1, wherein: The establishment of a dynamic risk threshold judgment mechanism includes: A two-dimensional risk assessment coordinate system is constructed with the individual risk score as the horizontal axis and the team collaboration risk index as the vertical axis; Calculate the judgment threshold parameters of each risk level based on the distribution characteristics of historical risk data in the risk assessment coordinate system; Delimiting risk level area boundaries in the risk assessment coordinate system using the judgment threshold parameters to form risk level determination rules; The calculated individual risk score and teamwork risk index are used as coordinate points, and the risk area to which they belong is determined according to the risk level determination rules, and the corresponding risk level is output; A security response strategy of corresponding strength is triggered according to the risk level matching result.

7. The software developer information security determination method according to claim 1, wherein: Optimizing the behavioral baseline model and the team risk propagation model includes: Build models to optimize datasets; Constructing an intelligent screening mechanism for training samples, evaluating the value of the model optimization data set, and screening model training samples; Perform parameter tuning and structural optimization on the behavioral baseline model and the team risk propagation model according to the analysis results; Establish a model optimization effect verification mechanism and decide whether to apply the optimized model parameters based on the verification results.

8. A software developer information security judgment system based on the software developer information security judgment method according to any one of claims 1 to 7, characterized in that: include, The data acquisition module is used to obtain historical core development behavior data of developers, construct multi-dimensional behavior feature vectors through feature fusion algorithms, and simultaneously construct a multi-dimensional collaboration relationship diagram of the development team; A baseline model building module is used to use the multi-dimensional behavior feature vector and the role behavior template to build a personalized behavior baseline model for each developer; A personal risk assessment module, which converts the core development behavior data collected in real time into a feature vector, compares it with the behavioral baseline model, calculates the behavioral deviation based on situational factors, and quantifies it into a personal risk score; A team risk assessment module is used to establish a team risk propagation model based on the multi-dimensional collaboration relationship diagram, analyze the abnormal behavior propagation path in combination with the individual risk score, and generate a team collaboration risk index; A security response execution module is used to establish a dynamic risk threshold judgment mechanism, determine the risk level by combining the individual risk score and the team collaboration risk index, and execute a corresponding security response strategy based on the risk level; The model optimization and updating module is used to collect evaluation data of the security response strategy and optimize the behavioral baseline model and the team risk propagation model based on data analysis.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the software developer information security judgment method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the software developer information security judgment method according to any one of claims 1 to 7 are implemented.

Images