Software supply chain interruption risk assessment method and device, equipment, medium and program product

Abstract

The invention provides a software supply chain interruption risk assessment method, and relates to the field of artificial intelligence, the field of information security, the field of financial science and technology or other technical fields, and the method comprises the steps: determining N terminal point entity nodes connected with a target software node according to a supply chain entity relation graph of target software; determining respective first scores in the N end point entity nodes; and calculating a second score of the target software according to the respective first scores in the N end point entity nodes, the second score indicating the risk degree of supply chain interruption of the target software.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence, information security, financial technology, or other technical fields, and more specifically, to a software supply chain disruption risk assessment method, apparatus, device, medium, and program product. Background Art

[0002] Driven by digitalization, the software supply chain is becoming increasingly complex, diverse, and globalized. Enterprises face numerous challenges in software supply chain management, including complex links, growing processes and supply chain lengths, and a multitude of suppliers. Risks can exist at every stage of the software supply chain, threatening the security of an enterprise's software supply chain.

[0003] In related technologies, risk indicator data corresponding to each risk indicator of each supplier can be determined based on the operational information and product information of multiple suppliers in the supply chain, the operational information of each supplier's products in the supply chain, and multiple preset risk indicators. Based on the risk indicator data and the preset supplier weights, a weighted calculation is performed on the comprehensive risk data of each supplier to obtain the comprehensive risk data of the supply chain.

[0004] In the process of realizing the concept of the disclosed invention, the inventors found that the software supply chain is becoming increasingly complex, the process and chain length are increasing, and there are many suppliers. The relevant technology only conducts risk assessment from the perspective of risk indicators, which has the problem of incomplete consideration and makes it difficult to conduct accurate and comprehensive quantitative assessment. Summary of the Invention

[0005] In view of the above problems, the present disclosure provides a software supply chain disruption risk assessment method, apparatus, device, medium, and program product.

[0006] According to a first aspect of the present disclosure, a software supply chain disruption risk assessment method is provided, comprising: determining, based on a supply chain entity relationship diagram of the target software, N end entity nodes connected to the target software node, where N is an integer greater than or equal to 1; determining a first score for each of the N end entity nodes, wherein the first score of at least one of the end entity nodes is obtained based on the first score of a starting entity node connected to it or the first score of an intermediate entity node in a risk propagation path, the first score indicating the risk level of the supply chain entity mapped by the node; and calculating a second score for the target software based on the first score of each of the N end entity nodes, wherein the second score indicates the risk level of the target software supply chain disruption.

[0007] According to an embodiment of the present disclosure, before determining the first score of each of the N terminal entity nodes, the method also includes calculating the first score of each entity node in the supply chain entity relationship graph, specifically including: obtaining an initial score based on the attributes of the supply chain entity mapped by each entity node; determining the risk propagation scores of the remaining entity nodes connected to each entity node through directed edges; and obtaining the first score of each entity node based on the initial score and the risk propagation score.

[0008] According to an embodiment of the present disclosure, in the supply chain entity relationship diagram, the first score of each of the starting point entity nodes is obtained according to the attributes of the supply chain entity to which it is mapped; and / or the first score of each of the intermediate entity nodes is obtained according to the first score of the connected starting point entity node or the first scores of the remaining intermediate entity nodes.

[0009] According to an embodiment of the present disclosure, determining the first score of each of the N terminal entity nodes includes: for each of the terminal entity nodes, determining the first score and risk propagation factor of each target entity node connected to each of the terminal entity nodes based on a directed edge, the target entity node including a starting entity node or an intermediate entity node; obtaining the first score of each of the terminal entity nodes based on a weighted sum of the first score and the risk propagation factor of each target entity node.

[0010] According to an embodiment of the present disclosure, calculating the second score of the target software based on the respective first scores of the N endpoint entity nodes includes: determining the first score and risk propagation factor of each of the endpoint entity nodes; and obtaining the second score of the target software based on a weighted sum of the first score and risk propagation factor of each of the endpoint entity nodes.

[0011] According to an embodiment of the present disclosure, the first score of each intermediate entity node is obtained based on the first score of the connected starting entity node or the first scores of the remaining intermediate entity nodes, including: for each intermediate entity node, determining the first score and risk propagation factor of each target entity node connected to each intermediate entity node based on a directed edge, the target entity node including the starting entity node or the intermediate entity node; obtaining the first score of each intermediate entity node based on the weighted sum of the first score of each target entity node and the risk propagation factor.

[0012] According to an embodiment of the present disclosure, the supply chain entity relationship diagram includes at least one type of entity node as follows: a component node, used to map the components on which the target software depends; a supplier node, used to map the supplier of the target software, or the supplier of the component; an authorization and licensing node, used to map the authorization and licensing document of the target software, or the authorization and licensing document of the component; a maintenance personnel node, used to map the maintenance personnel of the target software who belongs to the supplier, or the maintenance personnel of the component; a geographic location node, used to map the location of any supplier, or the location of any maintenance personnel.

[0013] Another aspect of an embodiment of the present disclosure provides a software supply chain disruption risk assessment device, comprising: an endpoint determination module, for determining N endpoint entity nodes connected to a target software node based on a supply chain entity relationship diagram of the target software, where N is an integer greater than or equal to 1; an endpoint scoring module, for determining a first score for each of the N endpoint entity nodes, wherein the first score of at least one of the endpoint entity nodes is obtained based on the first score of a starting entity node or a first score of an intermediate entity node connected to it in a risk propagation path, and the first score indicates the risk level of the supply chain entity mapped by the node; and an disruption assessment module, for calculating a second score for the target software based on the first score for each of the N endpoint entity nodes, wherein the second score indicates the risk level of a supply chain disruption for the target software.

[0014] Another aspect of an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described above.

[0015] Another aspect of an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor is caused to perform the method described above.

[0016] Another aspect of an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0017] One or more of the above-mentioned embodiments have the following beneficial effects: through the supply chain entity relationship diagram of the target software, the relationship between each supply chain entity in the software supply chain and the attributes of each supply chain entity can be intuitively displayed, and the relationship between entities, risk propagation paths and other relationships can be quickly discovered. On the basis of considering the risk propagation from the starting entity node or the intermediate entity node to the end entity node, the risk propagation from the end entity node to the target software node is further considered. That is, the layer-by-layer propagation of risks in the software supply chain is taken into account. Not only can the status of the entire software supply chain be intuitively monitored through the supply chain entity relationship diagram, but also the explicit and potential interruption risks that each supply chain entity in the software supply chain may cause to the target software based on the graph structure data, so as to achieve an accurate and comprehensive quantitative assessment of the supply chain interruption risk of the target software node. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 A diagram schematically illustrates an application scenario for implementing software supply chain disruption risk assessment according to an embodiment of the present disclosure;

[0020] Figure 2 Schematically shows a data structure diagram of a supply chain entity relationship diagram according to an embodiment of the present disclosure;

[0021] Figure 3 Schematically shows a supply chain entity relationship diagram according to an embodiment of the present disclosure;

[0022] Figure 4 A flowchart of a software supply chain disruption risk assessment method according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 A flowchart schematically illustrates a first scoring process for each entity node according to an embodiment of the present disclosure;

[0024] Figure 6 A flowchart for determining a first score of an endpoint entity node according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 7 Schematically shows a flow chart for calculating the second score of the target software according to an embodiment of the present disclosure;

[0026] Figure 8 A schematic diagram illustrating a structural block diagram of a software supply chain disruption risk assessment device according to an embodiment of the present disclosure is shown; and

[0027] Figure 9A block diagram of an electronic device suitable for implementing a software supply chain disruption risk assessment method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0029] Software supply chain security risks can be divided into two categories: cybersecurity risks and supply chain disruptions. Existing solutions mainly focus on how to identify and defend against cybersecurity risks caused by supply chain attacks that exploit weak links and supply chain product vulnerabilities. However, there is currently a lack of methods that can accurately and comprehensively quantify supply chain disruption risks caused by licensing changes, software product delisting, supplier bankruptcy, natural disasters, etc.

[0030] Some embodiments of the present disclosure provide a software supply chain disruption risk assessment method using graph-structured data. Through the supply chain entity relationship diagram of the target software, the relationship between each supply chain entity in the software supply chain and the attributes of each supply chain entity can be intuitively displayed, and the association between entities, risk propagation paths and other relationships can be quickly discovered. On the basis of considering the risk propagation from the starting entity node or the intermediate entity node to the end entity node, the risk propagation of the end entity node to the target software node is further considered. That is, the layer-by-layer propagation of risks in the software supply chain is taken into account. Not only can the status of the entire software supply chain be intuitively monitored through the supply chain entity relationship diagram, but also the explicit and potential disruption risks that each supply chain entity in the software supply chain may cause to the target software based on the graph-structured data, so as to achieve an accurate and comprehensive quantitative assessment of the supply chain disruption risk of the target software node.

[0031] Figure 1 The following schematically illustrates an application scenario diagram for implementing software supply chain disruption risk assessment according to an embodiment of the present disclosure. Figure 1 What is shown are merely examples to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0032] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0033] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0034] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0035] Server 105 can be a server that provides various services, such as a backend management server (for example only) that supports websites browsed by users using first terminal device 101, second terminal device 102, and third terminal device 103. The backend management server can analyze and process received user requests and other data, and provide feedback (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices. For example, server 105 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0036] For example, the software involved in the present disclosure may include applications such as client applications and web applications (abbreviated as APP in English), wherein the client (i.e., front-end) and the server (i.e., back-end) can communicate data through network messages. For example, in the APP client, the parameters that the server needs to obtain from the client are assembled, and the network request method is called to send them to the server.

[0037] It should be noted that the software supply chain disruption risk assessment method provided in the embodiments of the present disclosure can generally be executed by at least one of a terminal device or a server. Accordingly, the software supply chain disruption risk assessment device provided in the embodiments of the present disclosure can generally be installed in at least one of a terminal device or a server.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0039] The following will be based on Figure 1 The scene described by Figures 2 to 7 The software supply chain disruption risk assessment method according to an embodiment of the present disclosure is described in detail.

[0040] Figure 2 A data structure diagram of a supply chain entity relationship diagram according to an embodiment of the present disclosure is schematically shown. Figure 3 The diagram schematically shows a supply chain entity relationship diagram according to an embodiment of the present disclosure.

[0041] For example, data related to software supply chain disruption risks can be collected from data sources such as the enterprise's software management system and software bill of materials, and then analyzed as follows: Figure 2 The data structure shown in the figure processes and stores the data in a unified manner for subsequent use. The following will expand on the data collection and data processing of the supply chain entity relationship diagram.

[0042] During the data collection phase, the following information is obtained from the enterprise's internal software management system and software material list: Figure 2 The data shown includes software product information such as product name, version information, supplier, license information, and hash value. This type of data is usually structured data with a fixed format and is obtained from the data source through a customized data driver.

[0043] During the data processing phase, the collected data in different formats and structures are standardized and converted into a unified format for storage. To facilitate the subsequent construction of entity-relationship diagrams, structures corresponding to the various entity nodes in the entity-relationship diagram are used to store relevant information about the entities. Each structure has multiple fields for storing information related to each entity, such as name, version number, supplier information, etc. The structure also includes data describing the dependencies between entities. This design allows for the subsequent construction of entity-relationship diagrams to directly use this structured information to draw relationships between entities, such as the dependencies between software products and their components, and the connections between components and their suppliers.

[0044] In some embodiments, the supply chain entity relationship diagram includes a target software node, which maps a software product, including key attributes such as product name, version, supplier, licensing information, and maintainer.

[0045] For example, a supply chain entity relationship diagram includes at least one of the following entity nodes:

[0046] Component nodes are used to map the components that the target software depends on. Components include libraries, frameworks, or modules that the software product relies on. Component nodes include attributes such as name, version, vendor, and licensing information. Changes to licensing information or compatibility issues can affect the availability of the software product and cause supply chain disruptions.

[0047] Supplier nodes are used to map the target software or component suppliers. Suppliers are companies or organizations that provide software products and components and have actual control over them. Supplier nodes contain attributes such as supplier name, website (URL), contact information (phone number), and location. This information helps identify supply chain disruption risks caused by supplier factors.

[0048] The License node maps the target software's license document or component's license document. License documents control the use, distribution, and modification of software products and components. Changes to the license may render the software or component unusable. The License node contains attributes such as the license name, version, and issuing authority.

[0049] Maintainer nodes are used to map the maintainers of the target software or components affiliated with the vendor. Maintainers are individuals or organizations responsible for maintaining software products and components. The nodes contain attributes such as name, contact information, company, and location. This information can be used to assess the reliability and reachability of maintainers.

[0050] A geolocation node is used to map the location of any supplier or maintenance personnel. Both suppliers and maintenance personnel have geographic location attributes. Force majeure factors caused by geographic location (such as major natural disasters, import and export restrictions, etc.) may affect the supply of products and maintenance services, disrupt supply relationships, and create supply chain disruption risks.

[0051] Reference Figure 3 ,The dependency relationships between entities reflect the interactions and dependencies between entities such as software products, ,components, suppliers, and maintainers, as follows:

[0052] "hasComponent" relationship: A composition relationship exists between a software product and its components. A software product is usually not a single entity, but a complex system composed of multiple components.

[0053] "hasSupplier" relationship: A supplier relationship exists between a software product or component and its supplier. Software products and components are typically provided by suppliers, and changes or stability of suppliers directly affect the availability of software products and components.

[0054] Obey relationships: Ownership relationships represent the subordination of software products and components to licensing information. This relationship is based on the requirement that the legal use, distribution, and modification of software products and components must comply with licensing regulations. Any changes to licensing information may impact the software supply chain.

[0055] "hasMaintainer" relationship: This relationship describes the connection between software products and components and their maintainers. Software products and components require maintenance by maintainers, and interruptions in maintenance services can impact the stability of the software supply chain.

[0056] "employedBy" relationship: An employment relationship, which indicates the affiliation between a maintainer and a specific vendor. Maintainers are usually employed by a specific vendor.

[0057] "locatedAt" relationships: Location relationships indicate the geographic location of suppliers and maintenance personnel. This relationship indicates that the stability of the software supply chain is also affected by geography. Force majeure factors such as natural disasters or import / export restrictions can cause supply disruptions of software products or maintenance services.

[0058] After data collection and processing, a supply chain entity relationship diagram that can model the software supply chain can be constructed. The construction of the entity relationship diagram can reflect the complex relationships between entities in the software supply chain, provide a basis for subsequent risk assessment, and also facilitate users to intuitively view the structure of the entire software supply chain. Figure 3 The construction process of the supply chain entity relationship diagram shown may include the following steps:

[0059] (1) Entity recognition and extraction: Identify entity information, such as software products, suppliers, components, etc., from the collected and processed data, and extract relevant information from the structure that stores the entity information.

[0060] (2) Entity node creation: Use graph database tools to create a graph node for each entity and map the extracted information to node attributes so that users can view the detailed information of the node from the entity relationship diagram.

[0061] (3) Determination of relationship type: Analyze and determine the types of dependency relationships between entities, such as "dependency", "supply", "maintenance", etc.

[0062] (4) Adding directed edges: Based on the relationship between entities, use graph database tools to add directed edges between corresponding graph nodes. The attributes of the edges reflect the type of relationship.

[0063] (5) Graphical interface display: In order to intuitively display the entity relationship diagram stored in the graph database to users, a graphical user interface is used to visualize the entity relationship diagram.

[0064] The supply chain entity-relationship diagram (ERD) intuitively models the various supply relationships within the software supply chain, making it easier to derive new information from existing data. Specifically, the ERD includes six entity nodes and their interdependencies, covering key entity types such as software products, components, and suppliers. It also illustrates the complex interactions between them, such as supply, maintenance, and composition relationships.

[0065] Below, as Figure 3 Taking the supply chain entity relationship diagram shown in the figure as an example, the various execution steps of the software supply chain disruption risk assessment method are further explained.

[0066] Figure 4 The flowchart of the software supply chain disruption risk assessment method according to an embodiment of the present disclosure is schematically shown.

[0067] like Figure 4 As shown, this embodiment includes:

[0068] In operation S410, N terminal entity nodes connected to the target software node are determined based on the supply chain entity relationship diagram of the target software, where N is an integer greater than or equal to 1;

[0069] Refer to the process of building the supply chain entity relationship diagram above, and refer to Figure 3 The supply chain entity relationship diagram includes one or more software nodes and one or more entity nodes. Software nodes include target software nodes, such as the software product A node. Multiple entity nodes are connected sequentially with directed edges to form a risk propagation path. Entity nodes, based on their position within the same path, include a starting entity node, an intermediate entity node, and an end entity node. For example, a risk propagation path consisting of Geographic Location 3, Supplier 3, Component 2, and Software Product A has a starting entity node, a middle entity node, and a end entity node, including the Component 2 node.

[0070] It can be understood that in a risk propagation path, the terminal entity node is a special intermediate entity node and is also an entity node directly connected to the target product node.

[0071] like Figure 3 As shown, the terminal entity nodes connected to the software product A node include the component 1 node, the authorization license node, the supplier 1 node, and the component 2 node.

[0072] In operation S420, a first score is determined for each of the N end-point entity nodes, wherein the first score of at least one end-point entity node is obtained based on the first score of the connected start-point entity node or the first score of the intermediate entity node, and the first score indicates the risk level of the supply chain entity mapped by the node;

[0073] For example, the objective correlation between entity nodes can be used to consider the impact of each entity node in the form of risk propagation. In this way, the risk is considered to be transmitted in the form of propagation towards the target software node in each risk propagation path.

[0074] For example, risk assessment of each entity node can be completed before or after constructing the supply chain entity relationship diagram, or simultaneously with the construction of the relationship network diagram. For example, a scoring card algorithm (such as feature weighted fusion, Bayesian information fusion algorithm, etc.) or a machine learning algorithm (such as support vector machine algorithm, logistic regression algorithm, and decision tree algorithm, etc.) can be used to initially score the inherent risk of each entity node.

[0075] In operation S430 , a second score of the target software is calculated based on the first scores of the N endpoint entity nodes, wherein the second score indicates a risk level of supply chain disruption of the target software.

[0076] For example, the second score of the target software may be obtained by summing the first scores of the N endpoint entity nodes.

[0077] Alternatively, graph centrality analysis can be used to assess node importance. The number of connections to a node can be used to measure its importance. The more nodes a terminal entity node connects to, the greater its weight is assigned. The first scores of each of the N terminal entity nodes are then weighted to produce a second score for the target software.

[0078] Alternatively, machine learning techniques can be used to train a model to predict the risk of software supply chain disruption. By training on a large amount of historical data (including the first scores and other relevant features of end-point entities), it is possible to learn which types of end-point characteristics are highly correlated with supply chain disruption risk. The trained model is then used to process the end-point features and the first scores to predict the second score of the target software.

[0079] According to the embodiments of the present disclosure, in addition to considering the risk propagation from the starting entity node or intermediate entity node to the ending entity node, the risk propagation from the ending entity node to the target software node is further considered. This considers the layered propagation of risk within the software supply chain. This not only intuitively monitors the status of the entire software supply chain through the supply chain entity relationship diagram, but also uses the graph structure data to identify the explicit and potential disruption risks that each supply chain entity may pose to the target software, thereby enabling an accurate and comprehensive quantitative assessment of the supply chain disruption risk of the target software node.

[0080] In some embodiments, in the supply chain entity relationship diagram, the first score of each starting entity node is obtained according to the attribute of the supply chain entity it maps; and / or the first score of each intermediate entity node is obtained according to the first score of the connected starting entity node or the first scores of the remaining intermediate entity nodes. Figure 5 The steps shown are further explained.

[0081] Figure 5 The flowchart of the first scoring of each entity node according to an embodiment of the present disclosure is schematically shown.

[0082] Before determining the first scores of the N terminal entity nodes, the method further includes calculating the first score of each entity node in the supply chain entity relationship graph, such as Figure 5 As shown, this embodiment includes:

[0083] In operation S510 , an initial score is obtained according to the attributes of the supply chain entity mapped by each entity node;

[0084] Exemplarily, the initial score includes a score obtained based on attributes (such as financial status, historical performance, etc.) of the supply chain entity mapped by the entity node.

[0085] The premise of quantitative risk scoring is to have metrics that can be used for scoring. To identify disruption risks in the software supply chain, in some embodiments, a measurement model for quantitatively describing software supply chain disruption risks is proposed. The model includes seven specific risks that may cause software supply chain disruptions and corresponding metrics, as shown in Table 1.

[0086] The metrics in the model can be divided into three categories: the first is information that can be directly obtained from the entity-relationship diagram, such as authorization and licensing information; the second is information that needs to be further processed based on the data in the entity-relationship diagram. For example, by traversing all nodes related to software product A in the entity-relationship diagram and obtaining geographical location-related information in the nodes, the geographical distribution of suppliers and maintenance personnel of software product A can be statistically obtained. When the geographical location involved in software product A encounters import and export restrictions, natural disasters, etc., the supply interruption risk of software product A will be reflected in the initial score through metric indicators, and will be reflected in the risk propagation score of subsequent nodes through risk propagation; the third is information that needs to be manually supplemented by the user. For example, the user can measure the substitutability of software product A and score it based on experience and knowledge.

[0087] Table 1: Software supply chain disruption risk measurement model

[0088]

[0089] For example, "License Change" can be used as a metric to evaluate the Authorization and Licensing node, using attributes such as license information and change information to derive an initial score for the Authorization and Licensing node. "Product Delisting" and "Supplier Bankruptcy or Business Restructuring" can each be used as a metric to evaluate the Supplier node, using attributes such as the supplier's credit score and financial reports to derive an initial score for the Supplier node. "Poor Substitutability" and "Product Upgrade and Compatibility" can each be used as a metric to evaluate the Software node, using attributes such as substitutability, version update frequency, and the number of user-reported compatibility issues to derive an initial score for the Software node. "Technical Support and Service Level" can be used as a metric to evaluate the Maintenance Personnel node, using attributes such as user satisfaction surveys and fault response time to derive a score for the Maintenance Personnel node. "Occurrence of Force Majeure Factors Related to Geographic Location" can be used as a metric to evaluate the Geographic Location node, using the geographical distribution of suppliers, the geographical distribution of maintenance personnel (e.g., concentration; the more concentrated, the more dangerous, the lower the score), and the number of Force Majeure events in each location to derive an initial score for the Geographic Location node.

[0090] For example, the initial score range is [0, 10], where a higher score indicates a lower risk. The initial score is then calculated by taking a weighted average of the scores of one or more metrics. The initial score calculation formula is as follows: Formula 1:

[0091] Formula 1

[0092] Among them, S represents the node, represents the initial score; w iis the weight of the ith metric (e.g., supplier bankruptcy risk weight), which can be specified by the user based on experience, or obtained by performing algorithm optimization after mathematical statistics of historical data. The sum of the weights can be 1; M i (S) is the score of the ith metric; n is the total number of metrics.

[0093] In some embodiments, the current event of each entity node may be collected in real time, and the risk score of the current event may be assigned, and the initial score may be updated by adding or subtracting the risk score of the current event.

[0094] In operation S520 , risk propagation scores of remaining entity nodes connected to each entity node via directed edges are determined;

[0095] The risk propagation score includes a score that describes the risk level of an entity node affected by other connected entities based on the directed edges. If a component supplier experiences a supply service interruption, the risk may propagate to that supplier.

[0096] For the starting point entity node, it is not affected by other nodes and its risk propagation score is ignored (for example, 0).

[0097] For example, a risk matrix is ​​formed through expert experience, in which the risk propagation scores of different categories of entity nodes when connected are determined by qualitative and quantitative methods.

[0098] Alternatively, for any two connected physical nodes, the impact of the physical node farther from the target software node on the other physical node closer to the target software node is assessed and quantified to generate a historical score. Then, based on the current risk events and historical attributes of the physical node farther from the target software node, the risk propagation score is calculated using the historical score as a reference.

[0099] For example, for non-starting entity nodes, the risk propagation score is obtained based on the weighted initial scores of other connected entity nodes, as shown in Formula 2.

[0100] It can be understood that the risk propagation direction mentioned in this disclosure is to propagate in the direction of the target software node in the same path.

[0101] In operation S530 , a first score of each entity node is obtained according to the initial score and the risk propagation score.

[0102] The first score includes a comprehensive score of each entity node obtained by combining the initial score and the risk propagation score, as shown in Formula 2.

[0103] Formula 2

[0104] in, is the risk transmission score. P prop (S) is the first score; D(S) is the set of connected downstream entity nodes C; F C,S It is the risk propagation factor from node S to downstream node C. It can be specified by the user based on experience or obtained by algorithm optimization after mathematical statistics of historical data. C,S The sum of can be 1; P init (C) is the initial score of downstream node C.

[0105] Exemplarily, the risk propagation factor may be determined based on at least one of respective attributes of the two nodes, dependency relationships, directed edge directions, and real-time events collected by multiple data sources.

[0106] For example, centrality analysis methods can be used to determine the importance of each entity node in the supply chain network, such as degree centrality and betweenness centrality. By simulating the risk propagation process in the supply chain network, the risk propagation capacity of each node is analyzed. Based on the node's influence in risk propagation and the characteristics of the network structure, the risk propagation factor of each downstream entity node to the upstream entity node is determined.

[0107] Alternatively, the strength of the dependencies between supplier entities can be assessed, for example, through questionnaires, historical supply chain risk data, or expert assessments to determine the strength of each relationship. Based on the strength of the dependency, a weight is assigned to each directed edge, representing the risk propagation factor from the downstream entity node to the upstream entity node.

[0108] For example, if the downstream node is a licensing node, natural language processing (NLP) can be used to perform semantic analysis on the licensing document to identify restrictive clauses, such as those on scope of use, modification, and distribution. Risk quantification is then performed for each restrictive clause, assessing its potential impact on the software supply chain, such as the legal risks and supply chain disruptions that could result from a violation. Using the licensing node as a starting point, the risk propagation path and impact on upstream nodes (such as software nodes) are analyzed. Based on the risk quantification results for the restrictive clauses, a corresponding risk weighting factor is assigned to the licensing node.

[0109] It is understandable that the calculation method of the first score is not limited to Formula 2. For example, different risk levels can be divided according to the initial score and the score of each risk propagation score, and then the first score can be obtained based on multiple risk levels and a pre-constructed indicator scoring system.

[0110] According to an embodiment of the present disclosure, by comprehensively considering the initial score and the risk propagation score, a first score of each entity node can be obtained to more accurately characterize the key risk points in the software supply chain.

[0111] In some embodiments, obtaining the first score of each intermediate entity node according to the first score of the connected starting point entity node or the first scores of the remaining intermediate entity nodes includes: for each intermediate entity node,

[0112] A first score and a risk propagation factor of each target entity node connected to each intermediate entity node based on a directed edge are determined. The target entity node includes a starting entity node or an intermediate entity node. The risk propagation factor of the target entity node may be dynamically changed.

[0113] Based on the first score of each target entity node and the weighted sum of the risk propagation factors, a first score of each intermediate entity node is obtained.

[0114] like Figure 3 ,Take the supplier 3 node as an example, the geographical location 3 node and the supplier 3 node are connected ,through directed edges.

[0115] First, determine the first score (i.e., initial score) and risk propagation factor of the geographic location 3 node. The risk propagation factor of the geographic location 3 node can be dynamically changing. When different risk events occur at geographic location 3, the risk propagation factor will vary according to the event risk score of the risk event. For example, when extreme weather occurs at geographic location 3, the impact of risk propagation is greater, and the absolute value of the risk propagation factor can be larger. In the case where a smaller score indicates a greater risk, the risk propagation factor can be a negative value, so that, as shown in Formula 2 based on The calculated risk transmission score is negative.

[0116] Then, the first score of the supplier 3 node can be calculated as shown in Formula 2. In the case that the supplier 3 node is also connected to other downstream nodes, the risk propagation scores of the other downstream nodes can be obtained as shown in Formula 2 and added to the risk propagation score of the geographical location 3 node.

[0117] According to an embodiment of the present disclosure, a first score of an intermediate entity node may be obtained based on the idea of ​​risk propagation to accurately identify risk key points in the risk propagation path.

[0118] Figure 6 The flowchart of determining a first score of an endpoint entity node according to an embodiment of the present disclosure is schematically shown.

[0119] like Figure 6 As shown, this embodiment is one of the embodiments of operation S220, including:

[0120] In operation S610 , a first score and a risk propagation factor of each target entity node connected to each terminal entity node based on a directed edge are determined, the target entity node including a start point entity node or an intermediate entity node;

[0121] In operation S620 , a first score of each destination entity node is obtained based on a weighted sum of the first score of each target entity node and the risk propagation factor.

[0122] like Figure 3 The component 2 node shown is one of the end entity nodes of the software product A node. The target entity nodes connected to it include the maintenance personnel 2 node, the supplier 3 node, and the authorization license node. As shown in Formula 2, the P of the component 2 node can be obtained. prop (S), then, get the maintenance personnel 2 node, supplier 3 node and authorization license node for each , then get the P of component 2 node prop (S).

[0123] According to an embodiment of the present disclosure, a first score of an endpoint entity node may be obtained based on a risk propagation approach to accurately identify key risk points that directly affect the target software.

[0124] Figure 7 The flowchart of calculating the second score of the target software according to an embodiment of the present disclosure is schematically shown.

[0125] like Figure 7 As shown, this embodiment is one of the embodiments of operation S230, including:

[0126] In operation S710 , a first score and a risk propagation factor of each endpoint entity node are determined; in operation S720 , a second score of the target software is obtained based on a weighted sum of the first score and the risk propagation factor of each endpoint entity node.

[0127] like Figure 3 As shown in the figure, the terminal entity nodes of software product A node include component 1 node, license node, supplier 1 node and component 2 node. As shown in formula 2, the P of software product A node can be obtained. prop (S), then, get the value of each of the component 1 node, the license node, the supplier 1 node, and the component 2 node. , and then get the P of software product A node prop (S), the second score.

[0128] According to the embodiments of the present disclosure, the risk propagation of the end entity node to the target software node can be considered to accurately and comprehensively quantify the supply chain disruption risk of the target software node.

[0129] Based on the above software supply chain interruption risk assessment method, the present disclosure also provides a software supply chain interruption risk assessment device. Figure 8 The device is described in detail.

[0130] Figure 8 The following schematically shows a structural block diagram of a software supply chain disruption risk assessment device according to an embodiment of the present disclosure.

[0131] like Figure 8 As shown, the software supply chain disruption risk assessment device 800 of this embodiment includes an endpoint determination module 810 , an endpoint scoring module 820 and a disruption assessment module 830 .

[0132] The endpoint determination module 810 may perform operation S210 for determining N endpoint entity nodes connected to the target software node based on the supply chain entity relationship graph of the target software, where N is an integer greater than or equal to 1;

[0133] The endpoint scoring module 820 may perform operation S220 to determine a first score for each of the N endpoint entity nodes, wherein the first score of at least one endpoint entity node is obtained based on the first score of a connected origin entity node or the first score of an intermediate entity node, the first score indicating a risk level of the supply chain entity mapped by the node;

[0134] The disruption assessment module 830 may perform operation S230 to calculate a second score of the target software based on the first scores of the N endpoint entity nodes, wherein the second score indicates a risk level of a disruption in the supply chain of the target software.

[0135] In some embodiments, the software supply chain disruption risk assessment apparatus 800 may further include an entity node scoring module, which may perform operations S510 to S530, which are not described in detail herein. The endpoint scoring module 820 may call the entity node scoring module to perform operations S220, S610 to S630.

[0136] In some embodiments, the software supply chain disruption risk assessment apparatus 800 may further include an intermediate node scoring module, which may call the entity node scoring module to obtain a first score of the intermediate entity node.

[0137] In some embodiments, the interruption assessment module 830 may further perform operations S710 to S720 , which will not be described in detail herein.

[0138] For the parts not mentioned in the apparatus part, they can be understood with reference to the various embodiments of the above-mentioned method. That is, the apparatus part includes modules for executing the various steps of any one of the method embodiments described above. In addition, the implementation methods, technical problems solved, functions achieved, and technical effects achieved of each module / unit / subunit, etc. in the apparatus part embodiment are respectively the same or similar to the implementation methods, technical problems solved, functions achieved, and technical effects achieved of each corresponding step in the method part embodiment, and will not be repeated here.

[0139] According to an embodiment of the present disclosure, any multiple modules among the endpoint determination module 810, the endpoint scoring module 820, and the interruption assessment module 830 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module.

[0140] According to an embodiment of the present disclosure, at least one of the endpoint determination module 810, the endpoint scoring module 820, and the interruption assessment module 830 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware by any other reasonable means of circuit integration or packaging, or implemented in any one of software, hardware, and firmware, or in any appropriate combination of any of these. Alternatively, at least one of the endpoint determination module 810, the endpoint scoring module 820, and the interruption assessment module 830 may be at least partially implemented as a computer program module that, when executed, can perform the corresponding function.

[0141] Figure 9 A block diagram of an electronic device suitable for implementing a software supply chain disruption risk assessment method according to an embodiment of the present disclosure is schematically shown.

[0142] like Figure 9As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage unit 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0143] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, ROM 902, and RAM 903 are connected to each other via a bus 904. The processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and RAM 903. The processor 901 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in one or more memories.

[0144] According to an embodiment of the present disclosure, electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to bus 904. Electronic device 900 may also include one or more of the following components connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 908 including a hard disk; and a communication section 909 including a network interface card such as a LAN card or modem. Communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. Removable media 911, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 910 as needed, so that computer programs read from the removable media can be installed into storage section 908 as needed.

[0145] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0146] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above, and / or one or more memories other than ROM 902 and RAM 903.

[0147] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiments of the present disclosure.

[0148] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0149] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0150] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0151] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0152] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0153] Those skilled in the art will appreciate that the features described in the various embodiments of the present disclosure may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in the present disclosure. In particular, the features described in the various embodiments of the present disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of the present disclosure. All such combinations and / or couplings fall within the scope of the present disclosure.

[0154] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A software supply chain disruption risk assessment method, comprising: According to the supply chain entity relationship diagram of the target software, determine N terminal entity nodes connected to the target software node, where N is an integer greater than or equal to 1; Determining a first score for each of the N endpoint entity nodes, wherein the first score of at least one of the endpoint entity nodes is obtained based on the first score of a connected starting entity node or a first score of an intermediate entity node in the risk propagation path, the first score indicating the risk level of the supply chain entity mapped by the node; A second score of the target software is calculated based on the first scores of each of the N endpoint entity nodes, wherein the second score indicates a risk level of supply chain disruption of the target software.

2. The method according to claim 1, characterized in that Before determining the first score of each of the N terminal entity nodes, the method further includes calculating the first score of each entity node in the supply chain entity relationship graph, specifically including: Obtaining an initial score according to the attributes of the supply chain entity mapped by each entity node; Determine risk propagation scores of the remaining entity nodes connected to each entity node via directed edges; A first score for each entity node is obtained according to the initial score and the risk propagation score.

3. The method according to claim 2, characterized in that In the supply chain entity relationship diagram, The first score of each starting point entity node is obtained according to the attribute of the supply chain entity to which it is mapped; and / or The first score of each intermediate entity node is obtained according to the first score of the connected starting point entity node or the first scores of the remaining intermediate entity nodes.

4. The method according to claim 2, characterized in that Determining the first score of each of the N terminal entity nodes includes: for each of the terminal entity nodes, Determine a first score and a risk propagation factor for each target entity node connected to each of the end entity nodes based on a directed edge, wherein the target entity node includes a start entity node or an intermediate entity node; Based on the first score of each target entity node and a weighted sum of the risk propagation factors, a first score of each destination entity node is obtained.

5. The method according to claim 2, characterized in that Calculating the second score of the target software according to the first scores of the N endpoint entity nodes includes: Determining a first score and a risk propagation factor for each of the endpoint entity nodes; A second score of the target software is obtained based on a weighted sum of the first score of each of the endpoint entity nodes and the risk propagation factor.

6. The method according to claim 2, characterized in that The first score of each intermediate entity node is obtained according to the first score of the connected starting point entity node or the first scores of the remaining intermediate entity nodes, including: for each intermediate entity node, Determine a first score and a risk propagation factor for each target entity node connected to each intermediate entity node based on a directed edge, wherein the target entity node includes a starting entity node or an intermediate entity node; The first score of each intermediate entity node is obtained based on the first score of each target entity node and a weighted sum of the risk propagation factors.

7. The method according to any one of claims 1 to 6, characterized in that The supply chain entity relationship diagram includes at least one type of entity node as follows: Component nodes, used to map components that the target software depends on; A supplier node, used to map the supplier of the target software or the supplier of the component; An authorization license node, used to map the authorization license document of the target software or the authorization license document of the component; A maintainer node, used to map the maintainer of the target software or the maintainer of the component who belongs to the supplier; The geographic location node is used to map the location of any supplier or any maintenance personnel.

8. A software supply chain disruption risk assessment device, comprising: An endpoint determination module, configured to determine N endpoint entity nodes connected to a target software node based on a supply chain entity relationship diagram of the target software, where N is an integer greater than or equal to 1; an endpoint scoring module, configured to determine a first score for each of the N endpoint entity nodes, wherein the first score of at least one of the endpoint entity nodes is obtained based on the first score of a connected starting entity node or a first score of an intermediate entity node in the risk propagation path, the first score indicating the risk level of the supply chain entity mapped by the node; The interruption assessment module is configured to calculate a second score of the target software based on the first scores of each of the N endpoint entity nodes, wherein the second score indicates a risk level of interruption in the supply chain of the target software.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images