Open source agreement analysis method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to the technical field of computers, and discloses an open source protocol analysis method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining a preset analysis template and a source code package of an open source project, wherein the preset analysis template comprises at least one protocol attribute and an analysis object of the protocol attribute; analyzing a target open source protocol used by the source code package based on the preset analysis template to obtain a target analysis result of the analysis object of the at least one protocol attribute; and obtaining a protocol analysis result of the open source project based on the target analysis result of the analysis object. The present disclosure can solve the problem of analyzing the open source protocol used by the open source project.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to an open source agreement analysis method and device, electronic equipment and storage medium. BACKGROUND

[0002] The open source agreement is an indispensable part of the open source project, which is a normative text that authorizes users to legally use, modify and distribute software, and clearly stipulates the rights and obligations of the user to the code. When the integrator, provider and other users of the open source project use the open source agreement, if they fail to comply with the open source agreement, it will bring certain security risks to the open source project. Therefore, how to accurately analyze the open source agreement used by the open source project has become a problem to be solved. SUMMARY

[0003] Therefore, the present disclosure provides an open source agreement analysis method, device, electronic equipment and storage medium to solve the problem of analyzing the open source agreement used by the open source project.

[0004] In a first aspect, the present disclosure provides an open source agreement analysis method, which comprises:

[0005] obtaining a preset analysis template and a source code package of an open source project, wherein the preset analysis template comprises at least one protocol attribute and an analysis object of the protocol attribute;

[0006] analyzing a target open source agreement used by the source code package based on the preset analysis template to obtain a target analysis result of the analysis object of the at least one protocol attribute;

[0007] obtaining an agreement analysis result of the open source project based on the target analysis result of the analysis object.

[0008] In a second aspect, the present disclosure provides an open source agreement analysis device, which comprises:

[0009] a data acquisition module configured to obtain a preset analysis template and a source code package of an open source project, wherein the preset analysis template comprises at least one protocol attribute and an analysis object of the protocol attribute;

[0010] a first analysis module configured to analyze a target open source agreement used by the source code package based on the preset analysis template to obtain a target analysis result of the analysis object of the at least one protocol attribute;

[0011] a second analysis module configured to obtain an agreement analysis result of the open source project based on the target analysis result of the analysis object.

[0012] In a third aspect, the present disclosure provides an electronic device, comprising a memory and a processor, which are communicatively connected with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the open source agreement analysis method described above.

[0013] In a fourth aspect, the present disclosure provides a computer readable storage medium, which stores computer instructions for making a computer execute the open source agreement analysis method described above.

[0014] The open source agreement analysis method provided by the embodiments of the present disclosure can quickly analyze the target open source agreement used by the source code package of the open source project by obtaining the preset analysis template containing at least one protocol attribute and the analysis object of the protocol attribute, and can obtain the target analysis result of the analysis object of each protocol attribute. Furthermore, the target analysis result of the analysis object can be used to obtain the protocol analysis result of the open source project, so that the analysis problem of the open source agreement used by the open source project can be solved, and the relevant provisions of the open source agreement used by the open source project can be known through the protocol analysis result.

[0015] The beneficial effects of the open source agreement analysis device, the electronic device and the storage medium correspond to the beneficial effects of the open source agreement analysis method, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the specific embodiments of the present disclosure or the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present disclosure, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0017] Figure 1 FIG. 1 is a flow diagram of an open source agreement analysis method according to an embodiment of the present disclosure;

[0018] Figure 2 FIG. 2 is a schematic diagram of a preset analysis template according to an embodiment of the present disclosure;

[0019] Figure 3 FIG. 3 is a flow diagram of an analysis process of open source agreement information according to an embodiment of the present disclosure;

[0020] Figure 4 FIG. 4 is a flow diagram of another open source agreement analysis method according to an embodiment of the present disclosure;

[0021] Figure 5 FIG. 5 is a structural block diagram of an open source agreement analysis device according to an embodiment of the present disclosure;

[0022] Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are some but not all of the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

[0024] An operating system (for example, a Linux operating system) is composed of thousands of open source software from the kernel to the upper layer application, and each open source software follows different open source agreements. These agreements stipulate different rights and obligations for different subjects. With the increasingly severe network security situation, numerous open source communities and enterprises dedicated to operating system research and development and related fields have emerged, and they maintain a large number of open source projects, which will eventually be integrated into the developed operating system.

[0025] The open source agreement is an indispensable part of the open source project, which is a normative text that authorizes users to legally use, modify and distribute software, and clearly stipulates the rights and obligations of the user to the code. For the integrator, provider and other users of the open source project, it is crucial to fully understand the open source agreement status of the open source project they maintain, which helps users to timely grasp the agreement repository status of the operating system and effectively avoid risks.

[0026] If the user fails to strictly comply with the corresponding open source agreement when using the open source project and fails to perform the corresponding obligations, he or she may face certain security risks.

[0027] Therefore, according to the embodiments of the present disclosure, an open source agreement analysis method is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] An open source agreement analysis method is provided in the present embodiment, which can be used in electronic devices such as personal computers, server computers, mobile devices, etc. Figure 1 is a flowchart of an open source agreement analysis method according to an embodiment of the present disclosure, as shown in Figure 1 The flowchart includes the following steps:

[0029] In step S101, a preset analysis template and a source code package of an open source project are acquired, and the preset analysis template includes at least one protocol attribute and an analysis object of the protocol attribute.

[0030] Specifically, by collecting a large number of common open source protocols, combining the specification requirements of the open source protocols concerned by the open source project integrator, extracting the commonness and concerned items in different open source protocols, and summarizing the commonness and the concerned items, a template framework suitable for different open source protocols is formed. That is, the core part concerned in different open source protocols is extracted, the core part is divided into multiple items and classified, at least one protocol attribute and an analysis object of the protocol attribute are obtained, and a preset analysis template is formed. The preset analysis template meets the requirements of different open source protocol items as much as possible, and can be extended according to requirements.

[0031] Optionally, the at least one protocol attribute includes at least one of a first protocol attribute, a second protocol attribute, and a third protocol attribute; the first protocol attribute is used to represent an item allowed to be performed according to the open source protocol; the second protocol attribute is used to represent an item required to be performed according to the open source protocol; and the third protocol attribute is used to represent an item limited to be performed according to the open source protocol.

[0032] Specifically, the first protocol attribute is a right of the open source protocol, that is, what can be done by a user using the open source project under the current open source protocol. The second protocol attribute is an obligation of the open source protocol, that is, what must be done by the user using the open source project under the current open source protocol. The third protocol attribute is a limitation of the open source protocol, that is, what needs to be limited or prohibited if the user uses the open source project under the current open source protocol.

[0033] Optionally, referring to Figure 2 The analysis object of the first protocol attribute includes one or more of patent authorization, contact author, modification, private use, commercial use, and distribution. The analysis object of the second protocol attribute includes one or more of including installation guide / script, contact author, including copyright and license, listing modification, network access is also regarded as distribution, indicating original author, including original software, source code package can be obtained, and license “infectivity”. The third protocol attribute includes one or more of quality assurance, patent authorization, modification, use of trademarks, and commercial use.

[0034] In actual application, the above protocol attribute and the analysis object thereof can be adjusted according to actual conditions, which is not limited herein.

[0035] In step S102, a target open source protocol used by the source code package is analyzed based on the preset analysis template, and a target analysis result of the analysis object of at least one protocol attribute is obtained.

[0036] Specifically, the target open source protocol used by the source code package is found out, all the found target open source protocols are associated and mapped with the analysis objects of the summarized protocol attributes, if the analysis objects meet the requirements, the target analysis result of the analysis objects is determined as "yes", if the analysis objects do not meet the requirements, the target analysis result of the analysis objects is determined as "no", so as to obtain the first analysis result of the analysis objects of each protocol attribute.

[0037] In step S103, the protocol analysis result of the open source project is obtained based on the target analysis result of the analysis objects.

[0038] The open source protocol analysis method provided in the embodiment can quickly analyze the target open source protocol used by the source code package of the open source project by obtaining the preset analysis template containing at least one protocol attribute and the analysis object of the protocol attribute, and obtain the target analysis result of the analysis object of each protocol attribute. Furthermore, the protocol analysis result of the open source project can be obtained by using the target analysis result of the analysis object, so that the analysis problem of the open source protocol used by the open source project can be solved, and the relevant provisions of the open source protocol used by the open source project can be known through the protocol analysis result.

[0039] In some optional embodiments, the above step S102 includes:

[0040] In step a1, open source protocol information is found out in the source code package, the open source protocol information is used to represent the combination relationship of the target open source protocol used by the source code package, and the combination relationship is represented by the protocol name of the target open source protocol and a logical operator.

[0041] Specifically, the open source protocol information is the combination of the target open source protocol in the source code package. Since the combination of the open source protocol is various, and the writing of the protocol name of the open source protocol may not be standard, the protocol name of the target open source protocol in the open source protocol information is also different. For example, "GPLv2+ and (GPLv2 or GPLv3) and LGPLv2+ and MIT", "ASL 2.0 and (ASL 2.0 or LGPLv2+)", "Apache-2.0 and W3C and MPL-1.1 and GPL-2.0-or-later and Apache-1.1". Therefore, the combination of the target open source protocol of the open source project is a difficulty in open source protocol risk analysis. When analyzing the combination of the open source protocol, the protocol name of each open source protocol in the open source protocol information needs to be mapped to the standard name, so as to determine the target open source protocol used by the source code package.

[0042] In step a2, the target open source protocol used by the source code package is determined based on the open source protocol information.

[0043] Specifically, the target open source agreement is analyzed based on the standard open source agreement and the variant of the standard open source agreement in the source code package based on the open source agreement information, and the target open source agreement is obtained.

[0044] Step a3, based on the preset analysis template, the target open source agreement is analyzed, and the first analysis result of the analysis object of at least one protocol attribute in the target open source agreement is obtained.

[0045] Among them, each target open source agreement corresponds to three types of protocol attributes: rights, obligations and restrictions, and the first analysis result of the analysis object of the three types of protocol attributes in the target open source agreement can be determined.

[0046] Specifically, the obtained target open source agreement is associated and mapped with the preset analysis template, the existence of the analysis object of each protocol attribute in the target open source agreement is determined, and the first analysis result of the analysis object of at least one protocol attribute in the target open source agreement is obtained, so as to analyze the agreement required by the target open source agreement, so that the user can quickly obtain the requirements of the open source agreement in the maintained open source project on the protocol attributes (such as rights, obligations and restrictions). The first analysis result of the analysis object of the protocol attribute in the target open source agreement is collected as the basis for analyzing the relevant provisions of the open source agreement used by the open source project, so as to further analyze the open source agreement used by the open source project.

[0047] For example, if the analysis object exists in the target open source agreement, the first analysis result of the analysis object is determined to be "yes". If the analysis object does not exist in the target open source agreement, the first analysis result of the analysis object is determined to be "no", so as to obtain the first analysis result of the analysis object of each protocol attribute.

[0048] For example, as shown in the table 1, the first analysis result of the analysis object of each protocol attribute in the GPL-2.0-or-later is shown. Figure 2

[0049] Table 1 First analysis result of analysis object of different protocol attributes in GPL-2.0-or-later

[0050]

[0051] Step a4, based on the combination relationship represented by the open source agreement information and the logical operator, the first analysis result of the analysis object of at least one protocol attribute in different target open source agreements is processed, and the target analysis result of the analysis object of at least one protocol attribute is obtained.

[0052] ​Specifically, the existence of the analysis object corresponding to each protocol attribute of the target open source protocol combination represented by the open source agreement information is calculated according to the calculation formula of the combination relationship represented by the open source agreement information and the priority of the logical operator in the open source agreement information, so as to obtain the target analysis result of the analysis object of each protocol attribute.

[0053] In some optional embodiments, the step a2 comprises:

[0054] In step a21, preset agreement name information is obtained, and the preset agreement name information includes the standard name and the non-standard name of at least one preset open source agreement.

[0055] Specifically, the standard name and the non-standard name of different open source agreements are collected in different ways, the mapping relationship among the open source agreements, the standard name and the non-standard name is constructed, and the preset agreement name information is obtained, so as to facilitate subsequent analysis of the open source agreement used in the open source project. The non-standard name includes the alias or other non-standard name of the open source agreement.

[0056] It can be understood that the open source project may be maintained and spread by multiple users, especially in the open source Linux operating system, the open source project is maintained in the form of a binary package and a source code package, and the source code package of the open source project may be packaged by multiple users, and the packaging process may integrate multiple open source agreements, which may cause the problem of non-standard naming of the open source agreement. For example, the standard name of the open source agreement is "GPL-2.0-or-later", and the non-standard name is "GPLv2+", "GPL-2-or-later", "GPL-2.0+", etc. For example, the standard name of the open source agreement is "GPL-1.0-or-later", and the non-standard name is "GPL+", "GPL-1-or-later", "GPL-1.0+", etc.

[0057] In step a22, the protocol name in the open source agreement information is analyzed based on the preset agreement name information, and the target open source agreement used by the source code package is determined.

[0058] Specifically, if the protocol name of the open source agreement in the open source project is not standardized, the non-standard protocol name (i.e. the non-standard name) needs to be found by using the preset agreement name information. Then, the non-standard name is mapped to the corresponding standard name, that is, the protocol name in the open source agreement information is standardized.

[0059] It should be noted that in actual application, if all target open source protocols in the open source project cannot be collected at one time, the collected target open source protocols can be sorted and the target open source protocols used by the open source project can be improved continuously. For example, the protocol name of the open source protocol used by the open source project is found by manual searching to determine the target open source protocol. Alternatively, the protocol name of the possible open source protocol is found by screening such as data conversion (for example, conversion of the case of English letters), data processing (for example, removal of spaces), and the like, and the found protocol name is verified by manual operation according to the preset protocol name information to determine the target open source protocol. With the improvement of the target open source protocol, all open source protocols of the open source project in the code repository of the user (such as the integrator) can be covered, and thus all open source protocols in the source code package can be identified by the computer program, which provides a basis for subsequent analysis of the target open source protocol.

[0060] The open source protocol analysis method provided in the embodiment can set the standard name and the non-standard name of each preset open source protocol in advance, and thus the target open source protocol used by the source code package can be quickly identified by using the standard name and the non-standard name of the preset open source protocol, and the analysis efficiency of the open source protocol is improved.

[0061] In some optional embodiments, the step a4 includes:

[0062] In the step a41, the combination relationship represented by the open source protocol information is analyzed based on the priority of the logical operator in the open source protocol information to determine at least one operation object of an operation level and a target logical operator corresponding to the operation level. The operation object includes the target open source protocol of the current operation level and / or the second analysis result of the analysis object of each protocol attribute in the previous operation level.

[0063] Specifically, the logical operator includes one or more of a bracket (“( )”), a logical AND operator (“AND” operator), and a logical OR operator (“OR” operator).

[0064] In actual application, the combination relationship represented by the open source protocol information can be disassembled according to the priority of the logical operator to obtain at least one operation level. Each operation level can include two operation objects. For the top operation level, two target open source protocols can be included. For other operation levels, the target open source protocol of the current operation level and the second analysis result of the analysis object of each protocol attribute in the previous operation level are included.

[0065] Step a42, for each operation object of each operation level, based on the corresponding target logical operator, processing the first analysis result of the analysis object of at least one protocol attribute in the target open source protocol and the second analysis result in the previous operation level, to obtain the second analysis result of the analysis object of at least one protocol attribute in the current operation level.

[0066] It is worth noting that for some open source projects, especially the open source license of Linux source code package, it is usually a combination of multiple target open source protocols, and these combinations are various, and the protocol names of the target open source protocols are not standardized. How to deal with the combination relationship of the target open source protocol is a problem. The combination relationship of the target open source protocol mainly includes "AND", "OR", "(")" and other logical operators. In actual application, not only the calculation formula corresponding to the combination relationship of the target open source protocol needs to be parsed, but also these logical operators need to be processed to form the requirements of the new open source protocol. Not only the rights, obligations, restrictions and other protocol attributes and the analysis object of each protocol attribute are involved, but also the conventional "AND", "OR", "(")" and other logical operators cannot be blindly processed. When analyzing the combination relationship of the target open source protocol by using the logical operator, different preset weights need to be designed for different analysis objects of different protocol attributes. Then, according to the relationship among the rights, obligations, restrictions and other protocol attributes, the requirements of the open source protocol after the calculation of each sub-item in the calculation formula of the combination relationship are determined, so as to obtain the second analysis result of the analysis object of at least one protocol attribute in the current operation level.

[0067] Step a43, based on the second analysis result of the analysis object of at least one protocol attribute in the last operation level, obtaining the target analysis result of the analysis object of at least one protocol attribute.

[0068] It can be understood that if the logical operator includes parentheses, that is, "()", then for the combination of the target open source protocol, the analysis result of the combination of the target open source protocol in the parentheses corresponding to the analysis object is calculated first. Finally, the analysis result of the analysis object corresponding to each protocol attribute in the parentheses is the analysis result of the analysis object of the three protocol attributes of rights, obligations and restrictions, which can be regarded as a new open source protocol. Then, this new open source protocol will participate in the original combined operation, and finally the sequential calculation formula is obtained, and then the calculation formula is processed in sequence. The open source protocol state of the final open source project is presented to the user.

[0069] In some optional implementations, if the target logical operator is a logical AND operator, then in step a42 above, the first analysis result of the analysis object of at least one protocol attribute in the target open-source protocol and the second analysis result in the previous operation level are processed based on the corresponding target logical operator to obtain the second analysis result of the analysis object of at least one protocol attribute in the current operation level, including:

[0070] Step b1: For the analysis object of the first protocol attribute, perform an intersection operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level to obtain the second analysis result of the analysis object of the first protocol attribute in the current operation level.

[0071] Step b2: For the analysis object of the second protocol attribute, perform a union operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level to obtain the second analysis result of the analysis object of the second protocol attribute in the current operation level.

[0072] Step b3: For the analysis object of the third protocol attribute, perform a union operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level to obtain the second analysis result of the analysis object of the third protocol attribute in the current operation level.

[0073] Understandably, see Figure 3 For the "AND" operator, if the two open-source protocols before and after the "AND" operator (including the new open-source protocol formed by the second analysis result of the protocol attribute analysis object in the previous operation level) contain a first protocol attribute (rights), then during computation, the intersection of the analysis results of the corresponding protocol attribute analysis objects of the two open-source protocols is taken to obtain the analysis result of the protocol attribute analysis object in the current operation level, thus forming a new open-source protocol. If the two open-source protocols before and after the "AND" operator contain a second protocol attribute (obligation) or a third protocol attribute (restriction), then during computation, the union of the analysis results of the corresponding protocol attribute analysis objects of the two open-source protocols is taken to obtain the analysis result of the protocol attribute analysis object in the current operation level, thus forming a new open-source protocol.

[0074] In some optional implementations, if the target logical operator is a logical OR operator, then in step a42 above, the first analysis result of the analysis object of at least one protocol attribute in the target open-source protocol and the second analysis result in the previous operation level are processed based on the corresponding target logical operator to obtain the second analysis result of the analysis object of at least one protocol attribute in the current operation level, including:

[0075] Step c1, obtaining the preset weight corresponding to the analysis object of each protocol attribute.

[0076] Step c2, based on the preset weight, the first analysis result of the analysis object of the same protocol attribute in the target open source protocol is fused to obtain the first fusion result of each protocol attribute.

[0077] Step c3, based on the preset weight, the second analysis result of the analysis object of the same protocol attribute in the previous operation level is fused to obtain the second fusion result of each protocol attribute.

[0078] Step c4, based on the preset attribute filtering condition, the target fusion result is determined in the first fusion result and the second fusion result.

[0079] Step c5, based on the target fusion result, in the first analysis result corresponding to the target open source protocol and the second analysis result corresponding to the previous operation level, the second analysis result of the analysis object of each protocol attribute in the current operation level is determined.

[0080] It can be understood that for the "OR" operator, it is not the "OR" operation between the analysis results of the analysis objects of the protocol attributes, but the two options of this or that, which is the operation of choosing one of the two open source protocols. For the "OR" operator, the preset weight is set for each analysis object of the protocol attribute.

[0081] For example, for "rights", the user pays more attention to the analysis objects of "commercial use" and "distribution", and then to "modification", so when setting the preset weight of the analysis object of "rights", the preset weight of "commercial use" of "rights" can be set to 10, the preset weight of "distribution" can be set to 10, and the preset weight of "modification" can be set to 5. The preset weight of other analysis objects with low user attention can be set to 0 or 1. For "restrictions", the user pays more attention to "commercial use", and then to "modification", so when setting the preset weight of the analysis object of "restrictions", the preset weight of "commercial use" of "restrictions" can be set to 10, and the preset weight of "modification" can be set to 5. The same applies to "obligations". Generally, the user will implement these "obligations", but expects fewer "obligations". In actual application, the preset weight of the analysis object of "business" can be set according to actual needs.

[0082] In practical applications, the greater the calculated value of the "right" is, the better it is for the open source project. For example, the fusion result of all the analysis objects of the "right" must be greater than "20" to be selected, because it involves commercial use and distribution. For the "restriction", the fusion result of all the analysis objects of the "restriction" must be less than "10" to be selected, because it involves whether to allow commercial use. For the "obligation", the weight of the analysis object of interest can be set, and the smaller the value is, the better it is. According to the analysis object of interest, the type of agreement that needs to be complied with is screened out, and a new agreement is formed to participate in other calculations.

[0083] As one of the specific application examples, see Figure 4 The open source agreement analysis method of the present disclosure mainly includes the following steps: obtaining the standard name and non-standard name of the open source agreement to form a preset agreement name information. Extracting the analysis objects of the agreement attributes in the open source agreement to form the correspondence between the agreement attributes and the analysis objects to form a preset analysis template. Further, when analyzing the open source agreement of the open source project, the source code package of the open source project is obtained, and the open source agreement information in the source code package is searched. According to the preset agreement name information and the open source agreement information, the target open source agreement used by the source code package is determined. Then, according to the preset analysis template, the first analysis result of each agreement attribute analysis object in the target open source agreement is obtained. Based on the combination relationship of the target open source agreement represented by the open source agreement information, the first analysis object of the target open source agreement is processed to obtain the target analysis result of each agreement attribute analysis object, so as to obtain the agreement analysis result of the open source project.

[0084] The open source agreement analysis method of the present disclosure can quickly obtain the open source license information corresponding to all source code packages in the system repository through various means such as scripts, and process these open source information through the calculation method as shown in Figure 4 to quickly obtain the rights, obligations, restrictions, etc. in the open source license terms corresponding to each open source project maintained, so as to obtain which open source software is not allowed to be used commercially, not allowed to be distributed, not allowed to be modified, allowed to be modified but required to be open-sourced, etc. It can be seen that the open source agreement analysis method of the present disclosure provides a method for quickly searching the open source license status of the open source software repository, generalizes the division of open source agreements, maps open source agreements and combined agreements to the divided categories, and automatically summarizes and analyzes the open source software repository, which can effectively solve the problem of automatic analysis of open source agreements caused by non-standard open source agreement combination and writing. The present disclosure can help users quickly identify the risk items of the cited open source software.

[0085] This disclosed open-source license analysis method aims to rapidly analyze the open-source license status of user-maintained repositories through comprehensive and automated methods, and to classify and summarize the data. Furthermore, this invention supports handling situations where certain open-source projects repeatedly combine multiple open-source licenses in various forms, and addresses situations where open-source licenses are written in non-standard formats. This disclosed open-source license method can quickly analyze and summarize thousands of open-source software maintained by users, and promptly mitigate potential risks.

[0086] The open-source license analysis method disclosed herein can solve the problems of repeated nesting and combination of open-source licenses and non-standard license writing. It also summarizes and categorizes open-source licenses, and sorts out the rights, obligations and usage restrictions that users need to assume, so as to facilitate users to perform automated and rapid scanning of the open-source licenses they maintain.

[0087] This embodiment also provides an open-source protocol analysis device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0088] This embodiment provides an open-source protocol analysis device, such as... Figure 5 As shown, it includes:

[0089] The data acquisition module 501 is used to acquire a preset analysis template and the source code package of an open source project. The preset analysis template includes at least one protocol attribute and an analysis object of the protocol attribute.

[0090] The first analysis module 502 is used to analyze the target open source protocol used by the source code package based on a preset analysis template, and obtain the target analysis result of the analysis object with at least one protocol attribute.

[0091] The second analysis module 503 is used to obtain the protocol analysis results of the open source project based on the target analysis results of the analysis object.

[0092] In some alternative implementations, the first analysis module 502 includes:

[0093] The information lookup unit is used to find open source license information in the source code package. The open source license information is used to characterize the combination relationship of the target open source licenses used by the source code package. The combination relationship is characterized by the protocol name of the target open source license and logical operators.

[0094] The protocol determination unit is used to determine the target open-source protocol used by the source code package based on open-source protocol information.

[0095] The first analysis unit is configured to analyze the target open source protocol based on a preset analysis template, and obtain a first analysis result of an analysis object of at least one protocol attribute in the target open source protocol.

[0096] The second analysis unit is configured to process the first analysis result of the analysis object of the at least one protocol attribute in different target open source protocols based on the combination relationship represented by the open source protocol information and the logical operator, and obtain a target analysis result of the analysis object of the at least one protocol attribute.

[0097] In some optional embodiments, the protocol determination unit comprises:

[0098] The information acquisition sub-unit is configured to acquire preset protocol name information, and the preset protocol name information comprises a standard name and a non-standard name of at least one preset open source protocol.

[0099] The protocol determination sub-unit is configured to analyze a protocol name in the open source protocol information based on the preset protocol name information, and determine a target open source protocol used by the source code package.

[0100] In some optional embodiments, the second analysis unit comprises:

[0101] The first analysis sub-unit is configured to analyze the combination relationship represented by the open source protocol information based on a priority of the logical operator in the open source protocol information, determine an operation object of at least one operation level and a target logical operator corresponding to the operation level, and the operation object comprises a target open source protocol of a current operation level and / or a second analysis result of the analysis object of each protocol attribute in a previous operation level.

[0102] The second analysis sub-unit is configured to, for the operation object of each operation level, process the first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol and the second analysis result in the previous operation level based on the corresponding target logical operator, and obtain a second analysis result of the analysis object of the at least one protocol attribute in the current operation level.

[0103] The third analysis sub-unit is configured to obtain the target analysis result of the analysis object of the at least one protocol attribute based on the second analysis result of the analysis object of the at least one protocol attribute in the last operation level.

[0104] In some optional embodiments, the at least one protocol attribute comprises at least one of a first protocol attribute, a second protocol attribute and a third protocol attribute; the first protocol attribute is used to represent a matter allowed to be performed according to the open source protocol; the second protocol attribute is used to represent a matter required to be performed according to the open source protocol; and the third protocol attribute is used to represent a matter limited to be performed according to the open source protocol.

[0105] In some optional embodiments, the second analysis subunit is specifically configured to: if the target logical operator is a logical and operator, performing an intersection operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level for the analysis object of the first protocol attribute, to obtain the second analysis result of the analysis object of the first protocol attribute in the current operation level; performing a union operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level for the analysis object of the second protocol attribute, to obtain the second analysis result of the analysis object of the second protocol attribute in the current operation level; and performing a union operation on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the previous operation level for the analysis object of the third protocol attribute, to obtain the second analysis result of the analysis object of the third protocol attribute in the current operation level.

[0106] In some optional embodiments, the second analysis subunit is further specifically configured to: if the target logical operator is a logical or operator, obtaining a preset weight corresponding to each protocol attribute analysis object; performing fusion on the first analysis result of the same protocol attribute analysis object in the target open source protocol based on the preset weight, to obtain a first fusion result of each protocol attribute; performing fusion on the second analysis result of the same protocol attribute analysis object in the previous operation level based on the preset weight, to obtain a second fusion result of each protocol attribute; determining a target fusion result from the first fusion result and the second fusion result based on a preset attribute filtering condition; and determining the second analysis result of each protocol attribute analysis object in the current operation level from the first analysis result corresponding to the target open source protocol and the second analysis result corresponding to the previous operation level based on the target fusion result.

[0107] Further function descriptions of the above-mentioned modules and units are the same as those of the corresponding embodiments, which will not be repeated here.

[0108] The open source protocol analysis apparatus in the embodiment is presented in the form of functional units. The units herein refer to ASIC (Application Specific Integrated Circuit, Application Specific Integrated Circuit) circuits, processors and memories executing one or more software or fixed programs, and / or other devices that can provide the above functions.

[0109] The disclosure embodiments also provide an electronic device, which is described with reference to Figure 6 , Figure 6 is a structural block diagram of an electronic device provided by the optional embodiments of the disclosure, as shown in Figure 6As shown, the electronic device includes one or more processors 601, memory 602, and interfaces to connect the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other using different busses, and can be mounted on a common motherboard or in other manners, as desired. The processor can process instructions for execution within the electronic device, including instructions stored in the memory or on the memory to implement aspects of the GUI displayed on an external input / output device, such as a display device coupled to the interface. In some alternative implementations, multiple processors and / or multiple buses can be employed as desired to implement aspects of the electronic device. Also, various elements of the electronic device can be implemented in hardware, software, and / or firmware, as desired. Furthermore, any functions Figure 6 The processor 601 is taken as an example in the embodiment.

[0110] The processor 601 can be a central processing unit, a network processor, or a combination thereof. The processor 601 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic device, a general array logic, or any combination thereof.

[0111] The memory 602 stores instructions executable by the at least one processor 601 to cause the at least one processor 601 to perform the open source protocol analysis method shown in the above embodiment.

[0112] The memory 602 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function, and the like. The data storage area can store data created according to the use of the electronic device, and the like. In addition, the memory 602 can include a high-speed random access memory, and can further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid state storage device. In some alternative implementations, the memory 602 can optionally include a memory disposed remotely from the processor 601, and these remote memories can be connected to the electronic device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0113] The memory 602 can include a volatile memory, such as a random access memory, and can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid state disk. The memory 602 can further include a combination of the above-mentioned kinds of memories.

[0114] The electronic device also includes an input device 603 and an output device 604. The processor 601, the memory 602, the input device 603, and the output device 604 can be connected through a bus or other means, Figure 6 The connection through the bus is taken as an example.

[0115] The input device 603 can receive inputted digital or character information, and generate key signal input related to user settings and function control of the electronic device, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 604 can include a display device, an auxiliary lighting device (e.g., an LED), a tactile feedback device (e.g., a vibration motor), etc. The display device includes, but is not limited to, a liquid crystal display, a light-emitting diode, a display, and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0116] The embodiments of the present disclosure further provide a computer readable storage medium, and the method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or recorded in a storage medium, or be implemented as computer code originally stored in a remote storage medium or a non-transitory machine readable storage medium downloaded through a network and stored in a local storage medium, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, which, when accessed and executed by the computer, the processor, or the hardware, implements the open source protocol analysis method shown in the above embodiments.

[0117] Part of the present disclosure can be applied as a computer program product, for example, computer program instructions, when executed by a computer, through the operation of the computer, the method and / or technical solutions according to the present disclosure can be called or provided. Those skilled in the art should understand that the form of computer program instructions in a computer readable medium includes but is not limited to source files, executable files, installation package files, etc. Correspondingly, the way in which the computer program instructions are executed by the computer includes but is not limited to: the computer directly executes the instructions, or the computer executes the corresponding compiled program after compiling the instructions, or the computer reads and executes the instructions, or the computer executes the corresponding installed program after reading and installing the instructions. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0118] While embodiments of the present disclosure have been described in conjunction with the appended drawings, various modifications and changes can be suggested by those skilled in the art, and it is intended that the present disclosure encompass such modifications and changes as fall within the scope of the appended claims.

Claims

1. An open source protocol analysis method, characterized by, The method comprises: acquiring a preset analysis template and a source code package of an open source project, the preset analysis template comprising at least one protocol attribute and an analysis object of the protocol attribute; analyzing a target open source protocol used by the source code package based on the preset analysis template to obtain a target analysis result of the analysis object of the at least one protocol attribute; obtaining a protocol analysis result of the open source project based on the target analysis result of the analysis object; the analysis of the target open source protocol used by the source code package based on the preset analysis template to obtain the target analysis result of the analysis object of the at least one protocol attribute comprises: finding open source protocol information in the source code package, the open source protocol information being used to represent a combination relationship of the target open source protocol used by the source code package; the combination relationship being represented by a protocol name of the target open source protocol and a logical operator; determining the target open source protocol used by the source code package based on the open source protocol information; analyzing the target open source protocol based on the preset analysis template to obtain a first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol; processing the first analysis results of the analysis object of the at least one protocol attribute in different target open source protocols based on the combination relationship represented by the open source protocol information and the logical operator to obtain the target analysis result of the analysis object of the at least one protocol attribute.

2. The open source agreement analysis method according to claim 1, characterized by, the determination of the target open source protocol used by the source code package based on the open source protocol information comprises: acquiring preset protocol name information, the preset protocol name information comprising a standard name and a non-standard name of at least one preset open source protocol; analyzing the protocol name in the open source protocol information based on the preset protocol name information to determine the target open source protocol used by the source code package.

3. The open source agreement analysis method according to claim 1, characterized by, the processing of the first analysis results of the analysis object of the at least one protocol attribute in different target open source protocols based on the combination relationship represented by the open source protocol information and the logical operator to obtain the target analysis result of the analysis object of the at least one protocol attribute comprises: analyzing the combination relationship represented by the open source protocol information based on the priority of the logical operator in the open source protocol information to determine at least one operation object of an operation level and a target logical operator corresponding to the operation level, the operation object comprising a target open source protocol of the current operation level and / or a second analysis result of each protocol attribute analysis object in the previous operation level; for each operation object of the operation level, processing the first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol and the second analysis result in the previous operation level based on the corresponding target logical operator to obtain a second analysis result of the analysis object of the at least one protocol attribute in the current operation level. Based on the second analysis result of the analysis object of the at least one protocol attribute in the last operation level, a target analysis result of the analysis object of the at least one protocol attribute is obtained.

4. The open source agreement analysis method according to claim 3, characterized by, The at least one protocol attribute comprises at least one of a first protocol attribute, a second protocol attribute and a third protocol attribute; the first protocol attribute is used to represent a matter allowed to be executed according to the open source protocol; the second protocol attribute is used to represent a matter required to be executed according to the open source protocol; and the third protocol attribute is used to represent a matter limited to be executed according to the open source protocol.

5. The open source agreement analysis method according to claim 4, characterized by, If the target logical operator is a logical and operator, the processing of the first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol and the second analysis result in the last operation level based on the corresponding target logical operator to obtain the second analysis result of the analysis object of the at least one protocol attribute in the current operation level comprises: For the analysis object of the first protocol attribute, an intersection operation is performed on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the last operation level to obtain the second analysis result of the analysis object of the first protocol attribute in the current operation level; For the analysis object of the second protocol attribute, a union operation is performed on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the last operation level to obtain the second analysis result of the analysis object of the second protocol attribute in the current operation level; For the analysis object of the third protocol attribute, a union operation is performed on the first analysis result of the same analysis object in the target open source protocol and the second analysis result in the last operation level to obtain the second analysis result of the analysis object of the third protocol attribute in the current operation level.

6. The open source agreement analysis method according to claim 4, characterized by, If the target logical operator is a logical or operator, the processing of the first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol and the second analysis result in the last operation level based on the corresponding target logical operator to obtain the second analysis result of the analysis object of the at least one protocol attribute in the current operation level comprises: A preset weight corresponding to the analysis object of each protocol attribute is obtained; The first analysis result of the analysis object of the same protocol attribute in the target open source protocol is fused based on the preset weight to obtain a first fusion result of each protocol attribute; The second analysis result of the analysis object of the same protocol attribute in the last operation level is fused based on the preset weight to obtain a second fusion result of each protocol attribute; A target fusion result is determined from the first fusion result and the second fusion result based on a preset attribute filtering condition; and The target analysis result of the analysis object of the at least one protocol attribute is obtained. Based on the target fusion result, a second analysis result of each analysis object of the protocol attribute in the current operation level is determined from the first analysis result of the target open source protocol and the second analysis result of the previous operation level.

7. An open source protocol analysis apparatus characterized by comprising: The device comprises: a data acquisition module configured to acquire a preset analysis template and a source code package of an open source project, the preset analysis template comprising at least one protocol attribute and an analysis object of the protocol attribute; a first analysis module configured to analyze a target open source protocol used by the source code package based on the preset analysis template, to obtain a target analysis result of the analysis object of the at least one protocol attribute; a second analysis module configured to obtain a protocol analysis result of the open source project based on the target analysis result of the analysis object; the analysis of the target open source protocol used by the source code package based on the preset analysis template, to obtain the target analysis result of the analysis object of the at least one protocol attribute, comprises: searching for open source protocol information in the source code package, the open source protocol information being used to represent a combination relationship of the target open source protocol used by the source code package; the combination relationship being represented by a protocol name of the target open source protocol and a logical operator; determining the target open source protocol used by the source code package based on the open source protocol information; analyzing the target open source protocol based on the preset analysis template, to obtain a first analysis result of the analysis object of the at least one protocol attribute in the target open source protocol; processing the first analysis result of the analysis object of the at least one protocol attribute in different target open source protocols based on the combination relationship represented by the open source protocol information and the logical operator, to obtain the target analysis result of the analysis object of the at least one protocol attribute.

8. An electronic device, comprising: comprise: a memory and a processor, which are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the open source protocol analysis method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, which are used to make a computer execute the open source protocol analysis method in any one of claims 1 to 6.

Images