A supply chain security intelligence push early warning method and device

Abstract

The present disclosure discloses a supply chain security intelligence push early warning method and device, belonging to the technical field of network security. The method comprises: constructing a distributed supply chain intelligence network architecture, deploying distributed intelligence nodes at each key node; obtaining multi-source supply chain security intelligence data provided by each node and preprocessing; performing feature extraction processing on standardized intelligence data; using a machine learning model to perform threat assessment; according to the threat assessment result and the user attribute information, pushing customized early warning information to the corresponding supply chain node; collecting user feedback data, optimizing the machine learning model and the intelligence collection strategy. The present disclosure eliminates information silos through a distributed architecture, realizes real-time sharing and collaborative analysis of intelligence at each end of the supply chain, provides accurate risk early warning information and performs personalized push, continuously improves the early warning accuracy through a feedback optimization mechanism, and effectively enhances the resilience and stability of the supply chain when facing complex security environment.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity, and is particularly applicable to security risk monitoring and early warning in complex software supply chain environments. Background Technology

[0002] In the context of a globalized economy, the software supply chain has become increasingly complex and extensive, involving numerous links and participants, such as individual contributors, open-source communities, and closed-source commercial enterprises. These links are interconnected and interdependent; a problem in any link can have a serious impact on the entire supply chain, while security risks constantly threaten the stable operation of the supply chain.

[0003] Traditional methods of acquiring supply chain security intelligence have significant shortcomings. They rely primarily on manual collection and analysis of various intelligence sources, which is inefficient and untimely, making it difficult to respond to rapidly changing threat environments. Furthermore, existing intelligence-sharing mechanisms are inadequate, with severe information silos among participating parties, hindering the formation of effective collaborative risk warning mechanisms. Summary of the Invention

[0004] The purpose of this disclosure is to provide a supply chain security intelligence push and early warning method and device to realize real-time sharing and collaborative analysis of intelligence at all ends of the supply chain, provide accurate risk warning information and conduct personalized push.

[0005] To achieve the above objectives, this disclosure provides a supply chain security intelligence push and early warning method, including:

[0006] Construct a distributed supply chain intelligence network architecture, and deploy distributed intelligence nodes at each key node of the supply chain intelligence network architecture;

[0007] Acquire multi-source supply chain security intelligence data provided by each distributed intelligence node, and perform preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data.

[0008] The preprocessed standardized intelligence data is subjected to feature extraction processing to obtain structured intelligence feature data;

[0009] Based on the structured intelligence feature data, a machine learning model is used to conduct threat assessment and generate supply chain threat assessment results.

[0010] Based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes;

[0011] Collect user feedback data on the customized early warning information, optimize and adjust the machine learning model, and update the intelligence gathering strategy configuration.

[0012] Furthermore, a distributed supply chain intelligence network architecture is constructed, and distributed intelligence nodes are deployed at each key node of the supply chain intelligence network architecture, including:

[0013] Identify the core enterprises, open-source project teams, and commercial software vendor nodes in the supply chain intelligence network architecture, classify the nodes, and determine the deployment location of each distributed node based on the classification results.

[0014] Distributed intelligence node devices are installed at the locations where the distributed nodes are deployed to establish high-speed network links between supply chain nodes.

[0015] Based on the high-speed network link connection, a distributed message passing mechanism is constructed; the distributed message passing mechanism is used to asynchronously transmit intelligence data between various supply chain nodes.

[0016] Furthermore, multi-source supply chain security intelligence data provided by each distributed intelligence node is acquired, and the multi-source supply chain security intelligence data is preprocessed to obtain preprocessed standardized intelligence data, including:

[0017] Each distributed intelligence node connects to an external threat intelligence platform via API interface to obtain network security vulnerability data and attack event data, which are then aggregated to form the multi-source supply chain security intelligence data.

[0018] The multi-source supply chain security intelligence data is cleaned to remove duplicate records and irrelevant information;

[0019] The cleaned intelligence data is standardized and transformed to obtain the preprocessed standardized intelligence data.

[0020] Furthermore, feature extraction processing is performed on the preprocessed standardized intelligence data to obtain structured intelligence feature data, including:

[0021] Key security features are extracted from the preprocessed standardized intelligence data to generate an intelligence feature vector.

[0022] The intelligence feature vectors are organized in a structured manner to construct intelligence feature data under a unified data structure;

[0023] Based on the key features of each intelligence feature data, the intelligence feature data is fused to obtain the structured intelligence feature data.

[0024] Furthermore, based on the structured intelligence feature data, a machine learning model is used to perform threat assessment and generate supply chain threat assessment results, including:

[0025] Historical intelligence data is used as training samples to build a machine learning threat assessment model;

[0026] The structured intelligence feature data is input into the machine learning threat assessment model to calculate the threat level score;

[0027] The supply chain threat assessment results are generated by ranking risks based on the threat level scores.

[0028] Furthermore, based on the structured intelligence feature data, threat assessment is performed using a machine learning model to generate supply chain threat assessment results, which also includes:

[0029] Construct a deep learning model to extract semantic features from intelligence texts and generate semantic feature vectors;

[0030] A multilayer perceptron model is established to process the semantic feature vectors and output threat type classification results and risk scores.

[0031] An ensemble learning approach is used to combine the prediction results of multiple machine learning models on the semantic feature vector to calculate the overall threat level.

[0032] Based on supply chain topology analysis, the threat propagation path is analyzed, and the influence weights between nodes are calculated.

[0033] The potential impact range of the threat on the entire supply chain is assessed based on the impact weight. Based on the potential impact range, the threat type classification results, the risk score, and the comprehensive threat level, the supply chain threat assessment results including propagation analysis are generated.

[0034] Furthermore, based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes, including:

[0035] Obtain user role type, business focus, and risk tolerance as user attribute information;

[0036] Based on the user attribute information and supply chain threat assessment results, a matching score is calculated using a personalized recommendation algorithm;

[0037] Based on the matching score and the threat urgency indicated by the supply chain threat assessment results, differentiated early warning content is generated, forming the customized early warning information.

[0038] Furthermore, based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes, which also includes:

[0039] The node weight coefficient of each supply chain node is determined based on the business scale and technical capabilities of each node.

[0040] Based on the node weight coefficients, the intelligence data provided by each supply chain node are weighted and fused to calculate a weighted credibility score.

[0041] Based on the weighted credibility score, intelligence from multiple supply chain nodes regarding the same threat is fused and analyzed to generate fused threat intelligence;

[0042] Based on the fused threat intelligence, calculate the impact chain of threat propagation and analyze the business dependencies between nodes;

[0043] Based on the business dependencies between the nodes, customized early warning information is generated for each node, taking into account the impact on upstream and downstream.

[0044] Furthermore, user feedback data on the customized early warning information is collected to optimize and adjust the machine learning model and update the intelligence gathering strategy configuration, including:

[0045] The system collects user ratings on the accuracy and relevance of alerts through a feedback interface.

[0046] Based on the scoring data, the parameters of the machine learning model were adjusted using the gradient descent algorithm, and the threat assessment model was retrained.

[0047] Based on the false alarms and omissions reported in the feedback, the frequency and scope of intelligence gathering will be dynamically adjusted.

[0048] Establish a feedback evaluation index system to calculate the optimization effect of the model, and apply new model parameters when the accuracy improvement exceeds the set threshold.

[0049] This disclosure also provides a supply chain security intelligence push and early warning device based on a distributed architecture, including:

[0050] A distributed architecture building module is used to build a distributed supply chain intelligence network architecture and deploy distributed intelligence nodes at each key node of the supply chain intelligence network architecture.

[0051] The intelligence preprocessing module is used to acquire multi-source supply chain security intelligence data provided by each distributed intelligence node, and to perform preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data.

[0052] The feature extraction module is used to perform feature extraction processing on the preprocessed standardized intelligence data to obtain structured intelligence feature data.

[0053] The threat assessment module is used to perform threat assessment based on the structured intelligence feature data using a machine learning model, and generate supply chain threat assessment results.

[0054] The personalized push module is used to push customized early warning information to the corresponding supply chain nodes based on the supply chain threat assessment results and user attribute information.

[0055] The feedback optimization module is used to collect user feedback data on the customized early warning information, optimize and adjust the machine learning model, and update the intelligence collection strategy configuration.

[0056] A computer device is also provided, including a processor and a memory, the memory being used to store computer program instructions, and the processor being used to execute the computer program instructions to perform any of the above-described supply chain security intelligence push and early warning methods.

[0057] Based on the above, the embodiments disclosed herein can achieve the following:

[0058] Efficient Intelligence Sharing: By eliminating information silos through a distributed architecture, real-time sharing and collaborative analysis of intelligence across the supply chain are achieved, breaking down barriers in traditional intelligence sharing mechanisms and improving intelligence flow efficiency. Precise Risk Warning: Based on machine learning models and dynamic analysis mechanisms, potential security risks in the supply chain can be accurately identified, providing personalized and customized warning information, effectively reducing false alarms and missed alarms, and helping users take proactive measures to prevent risk spread. Dynamic Self-Optimization: Employing a feedback and optimization closed-loop mechanism, models and intelligence gathering strategies can be continuously improved based on user feedback (e.g., increasing the frequency of intelligence gathering from open-source communities and related commercial software vendors), constantly improving the accuracy of warnings and the rationality of intelligence gathering strategies, adapting to the ever-changing security landscape of the supply chain, and forming a sustainable warning ecosystem. Enhanced Supply Chain Resilience: Furthermore, personalized, timely, and accurate intelligence delivery helps all participants in the supply chain respond quickly to security threats, collaboratively fix vulnerabilities, reduce the impact of risks on the supply chain, and enhance the resilience and stability of the entire supply chain in the face of complex security environments. Attached Figure Description

[0059] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0060] Figure 1 This is a schematic diagram illustrating intelligence gathering and fusion provided for an embodiment of the present disclosure;

[0061] Figure 2 A schematic diagram illustrating the customized data collection by distributed nodes for different intelligence source types;

[0062] Figure 3 A flowchart of the supply chain security intelligence push and early warning method provided in this embodiment of the disclosure;

[0063] Figure 4 This is a schematic diagram of the architecture of the supply chain security intelligence push and early warning device provided in the embodiments of this disclosure;

[0064] Figure 5 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0066] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0067] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0068] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments.

[0069] Research has revealed that supply chain security intelligence technology has limited intelligence gathering coverage, focusing only on some key nodes and failing to adequately address the potential risks of numerous small and medium-sized participants; intelligence analysis is mostly static, unable to dynamically track the evolution of risks; intelligence sharing mechanisms are lagging behind, lacking efficient collaborative platforms, resulting in delays and barriers in intelligence transmission; and early warning accuracy is low, lacking mechanisms for intelligence quality assessment and feedback optimization, making it difficult to meet the personalized needs of different users.

[0070] Furthermore, the relevant sharing mechanisms lack standardized data formats and interface specifications, resulting in poor compatibility among participating systems. The intelligence transmission process suffers from data loss and duplicate processing, and there is a lack of incentive mechanisms to ensure the enthusiasm for intelligence contributions. At the same time, the early warning model does not fully consider the credibility, relevance, and timeliness of intelligence, employing generic threshold rules that easily generate numerous false positives and false negatives, making it difficult to meet the differentiated early warning needs of different users (such as core enterprises focusing on high-risk supply chain paths, and small suppliers prioritizing their own code security).

[0071] Based on this, this disclosure constructs a supply chain security intelligence push and early warning system based on a distributed architecture. At the architectural level, a multi-node distributed deployment is adopted, with each node corresponding to different key entities in the supply chain (such as core enterprises, teams, etc.). They are interconnected through network links to achieve efficient transmission and sharing of intelligence information (achieving comprehensive intelligence collection coverage). Simultaneously, a message queue mechanism is introduced to asynchronously transmit intelligence data between nodes, ensuring the system's stability and reliability under high-concurrency scenarios. Figure 1 As shown, by analyzing and aggregating the intelligence from each distributed node, information silos are eliminated, enabling real-time sharing and collaborative analysis of intelligence across the supply chain.

[0072] In addition, for each distributed node, such as Figure 2 As shown, each distributed node can be equipped with multiple intelligence gathering plugins for customized collection of different intelligence sources. These include: external threat intelligence source integration: establishing API connections with professional cybersecurity threat intelligence platforms and industry security association databases to pull the latest cybersecurity vulnerabilities, cyberattacks, malware samples, and other intelligence in real time. This intelligence may directly affect the security of the supply chain information system, thereby impacting physical logistics and transaction processes; internal operational data monitoring: monitoring various environments within the supply chain in an internal laboratory, triggering an intelligence generation mechanism when indicators exceed normal ranges, and incorporating the operational anomaly intelligence into the analysis; and integration with other intelligence push nodes: integrating intelligence pushed by other nodes in the architecture. After collecting operational intelligence from various channels, the intelligence push module can store and push the collected intelligence, such as... Figure 2 The distributed relational database "tidb" and the in-memory database "redis" are examples.

[0073] Furthermore, this embodiment establishes a robust feedback collection mechanism. Upon receiving early warning information, each intelligence recipient can provide feedback to the corresponding distributed nodes regarding the accuracy, relevance, and effectiveness of the actual countermeasures taken. This feedback data will be aggregated into the intelligence platform. On one hand, it will be used to continuously retrain the machine learning model, optimize model parameters and algorithm structure, and improve the accuracy of future early warnings. On the other hand, the feedback information will drive the dynamic adjustment of intelligence collection strategies, such as increasing the collection weight of intelligence sources in specific regions or industries, or optimizing the threshold settings of internal data monitoring indicators, so that the entire intelligence push and early warning system forms a continuously self-optimizing closed-loop ecosystem.

[0074] like Figure 3 As shown in the figure, this disclosure provides a supply chain security intelligence push and early warning method, including the following steps:

[0075] Step S1: Construct a distributed supply chain intelligence network architecture and deploy distributed intelligence nodes at each key node of the supply chain intelligence network architecture.

[0076] In this embodiment, as Figure 3 As shown, a distributed supply chain intelligence network architecture is constructed, and distributed intelligence nodes are deployed at each key node of the supply chain intelligence network architecture. Specifically, this includes: identifying core enterprises, open source project teams, and commercial software vendor nodes in the supply chain intelligence network architecture, classifying the nodes, and determining the deployment location of each distributed node based on the classification results; installing distributed intelligence node devices at the deployment locations of the distributed nodes, and establishing high-speed network links between supply chain nodes; constructing a distributed message passing mechanism based on the high-speed network links; and using the distributed message passing mechanism to asynchronously transmit intelligence data between supply chain nodes.

[0077] Here, distributed nodes are deployed at core enterprises, open-source project teams, and commercial software vendors, respectively. These nodes are connected via high-speed network links to form an intelligence-sharing network. Each node activates an intelligence-gathering plugin. Core enterprise nodes connect to a professional cybersecurity threat intelligence platform to obtain real-time vulnerability information and attack events targeting their business systems; open-source project team nodes monitor code repositories and community forums to collect discussions of potential security vulnerabilities and clues to malicious code submissions; commercial software vendor nodes monitor internal testing environments and user feedback channels to detect abnormal product operation. The intelligence platform uses machine learning algorithms to fuse and analyze the collected multi-source intelligence, identifying potentially high-risk links in the supply chain, such as an open-source component with a high-risk vulnerability that is widely used by multiple commercial software programs.

[0078] In practical implementation, the first step is to identify key nodes in the supply chain, including core enterprises (such as large software developers and system integrators), open-source project teams (such as open-source library maintenance teams and open-source framework communities), and commercial software vendors (such as component providers and tool software developers). These nodes are categorized based on their importance, business scale, and technical characteristics to determine the deployment locations and number of distributed intelligence nodes. Next, distributed intelligence node devices are installed at the determined deployment locations. These devices can be dedicated intelligence gathering servers or software modules integrated into existing business systems. Connections between nodes are established via high-speed network links (such as dedicated lines and VPNs) to ensure efficient transmission of intelligence data. Finally, based on these high-speed network links, a distributed message passing mechanism is constructed, employing message queue technologies (such as Kafka and RabbitMQ) to achieve asynchronous communication between nodes, ensuring reliable transmission of intelligence data even in the event of network fluctuations or node failures.

[0079] In the aforementioned process, determining the deployment locations of distributed nodes within the supply chain intelligence network architecture is a systematic project that comprehensively considers multiple dimensions, including node type characteristics, network topology, and business importance. First, a detailed classification and analysis can be conducted on the identified core enterprise, open-source project team, and commercial software vendor nodes. For core enterprise nodes, their centrality in the supply chain, business scale, and technical capabilities are assessed, typically categorizing them into two subclasses: "critical hub" and "important business." For open-source project team nodes, their code repository activity, community size, and component usage breadth are examined, classifying them into three subclasses: "infrastructure," "tool framework," and "application component." For commercial software vendor nodes, based on their product type, customer reach, and technical complexity, they are categorized into three subclasses: "platform service," "professional tool," and "industry solution." This fine-grained classification provides a scientific basis for subsequent deployment location determination.

[0080] When determining deployment locations based on node classification results, a three-dimensional assessment framework of "importance-risk-coverage" can be adopted. First, for core enterprise nodes assessed as "critical hubs," high-performance intelligence node equipment should be deployed in both their primary data center and backup center to ensure information processing capabilities and reliability. For "important business" core enterprises, intelligence nodes should be deployed in the network areas where their main business systems are located, based on their business distribution characteristics. Second, for open-source project team nodes, "infrastructure" projects, due to the widespread use of their components, should prioritize deploying lightweight intelligence gathering nodes in their code hosting platforms and continuous integration environments to monitor code changes and security discussions in real time. "Tool framework" and "application component" projects should selectively deploy intelligence nodes in community forum servers or the development environments of major contributors, depending on their scope of influence. Finally, for commercial software vendor nodes, "platform service" vendors, due to the significant impact of their products on downstream customers, should deploy intelligence nodes in their product development environments, testing environments, and customer support systems. "Professional tool" and "industry solution" vendors should primarily deploy intelligence nodes in their product release systems and vulnerability response platforms.

[0081] In practical deployment, network topology optimization can also be considered. By constructing a graph model of the supply chain network, metrics such as degree centrality, betweenness centrality, and proximity centrality of each node can be calculated to identify critical paths and potential bottlenecks in the network. Increasing the density of intelligence nodes at these key locations ensures efficient information flow. For example, at the connection points between multiple open-source projects and core enterprises, relay nodes with enhanced analytical capabilities can be deployed to improve the efficiency of cross-organizational information transmission. Simultaneously, we will assess the geographical distribution characteristics of each node. For geographically dispersed global supply chains, regional intelligence aggregation nodes can be deployed in different regions to reduce cross-regional transmission latency and improve the real-time nature of intelligence sharing.

[0082] Furthermore, node deployment can also take into account the organization's security policies and resource constraints. For core enterprises with high security requirements, we deploy secure gateway-type intelligence nodes with strict access control mechanisms at the boundary between their internal and external networks to ensure that intelligence sharing does not introduce additional security risks. For small and medium-sized open-source project teams with limited resources, we adopt a lightweight cloud-based intelligence node solution to reduce deployment and maintenance costs. Ultimately, based on three factors—node importance score, network location advantages, and resource constraints—we have developed a hierarchical and focused node deployment strategy. This ensures that high-performance nodes are deployed in critical locations, standard nodes in general locations, and lightweight nodes at the edge, forming a comprehensive, focused, and rationally allocated distributed intelligence network architecture.

[0083] This scientific deployment method based on classification results enables the construction of a distributed network architecture that can meet the specific needs of various nodes and achieve efficient sharing of overall supply chain security intelligence, providing solid infrastructure support for the collection, analysis, and early warning of supply chain security intelligence.

[0084] For example, in a supply chain intelligence network architecture, there is a close correlation between the importance, business scale, and technical characteristics of nodes and the deployment location and number of distributed intelligence nodes. Take a large software ecosystem as an example. In this ecosystem, the core enterprise A is a large operating system provider with an importance rating of "critical hub." Its business scale covers the globe, its technical architecture is complex, and it owns multiple data centers. Based on these characteristics, one high-performance primary intelligence node (16-core processor, 128GB memory, 10TB storage) can be deployed in its Beijing headquarters data center, one medium-sized backup intelligence node (8-core processor, 64GB memory, 5TB storage) can be deployed in each of its backup data centers in Shanghai and Guangzhou, and one regional coordination node can be deployed in each of its international business centers (USA, Europe, Singapore). This "1+2+3" deployment scheme ensures that intelligence processing capabilities match its business scale and importance, while meeting the needs of its global business through geographical distribution.

[0085] In contrast, for open-source project team B (which maintains a widely used cryptographic library), classified as "infrastructure-type," while its importance is high, its business scale is smaller, its technical architecture is relatively simple, and it mainly relies on GitHub for code hosting and community communication. For this type of node, we adopted a "lightweight distributed" deployment strategy, deploying one code monitoring intelligence node (integrated via API) on its GitHub code repository server, one discussion monitoring intelligence node on its community forum server, and three lightweight client nodes (2-core processor, 8GB memory, 500GB storage) in the core maintainer's development environment. Although this "1+1+3" deployment scheme is smaller in overall scale than the core enterprise A, it specifically covers the key information sources of the open-source project, ensuring timely capture of critical intelligence such as code changes, vulnerability discussions, and fix progress.

[0086] For vendor C, a "platform service" business software provider (offering a widely used cloud service platform), its importance rating is "high." While its business scale is medium, its technical complexity is high and its customer base is broad. We deployed one intelligence node in its product development center, one intelligence node in its testing environment, one enhanced intelligence node (12-core processor, 96GB memory, 8TB storage, equipped with dedicated security analytics components) in its security response center, and one customer feedback intelligence node in its customer support system. This balanced "1+1+1+1" deployment scheme covers the entire lifecycle from development to customer support, with a particular emphasis on strengthening intelligence processing capabilities in the security response phase, aligning with its characteristics as a platform service provider.

[0087] In practical deployments, deployment density can be adjusted based on dependencies between nodes. For example, if it is discovered that a commercial software vendor D's product heavily relies on components from open-source project B, a dedicated dependency monitoring node can be added at the interface between D and B to focus on monitoring the potential impact of B component updates on D's product. This additional deployment based on dependencies ensures that critical paths in the supply chain are adequately monitored.

[0088] Resource constraints are also a significant factor affecting deployment. For small and medium-sized nodes with limited resources, such as the "application component-based" open-source project E, a cloud-hosted intelligence node service can be used, integrating a lightweight intelligence gathering plugin only into its main code repository, eliminating the need to deploy independent hardware devices and significantly reducing deployment costs. Conversely, for large core enterprises with ample resources, more high-specification nodes can be deployed to provide more powerful local analysis capabilities.

[0089] This differentiated deployment strategy enables the rational allocation of intelligence node resources—more and higher-specification intelligence equipment is deployed at important nodes; distributed intelligence networks are deployed across multiple geographical locations for nodes with large business scales; and nodes with high technical complexity are equipped with specialized intelligence analysis components. This deployment scheme, which is closely integrated with the characteristics of each node, ensures the efficient operation of the entire supply chain intelligence network, avoiding resource waste while guaranteeing the completeness of intelligence coverage in key links.

[0090] Step S2: Obtain multi-source supply chain security intelligence data provided by each distributed intelligence node, and perform preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data.

[0091] In this embodiment, multi-source supply chain security intelligence data provided by each distributed intelligence node is acquired, and preprocessing operations are performed on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data. Specifically, this includes: each distributed intelligence node connecting to an external threat intelligence platform through an API interface to acquire network security vulnerability data and attack event data, and aggregating them to form multi-source supply chain security intelligence data; performing data cleaning on the multi-source supply chain security intelligence data to remove duplicate records and irrelevant information; and standardizing the cleaned intelligence data to obtain preprocessed standardized intelligence data.

[0092] Specifically, each distributed intelligence node connects to external threat intelligence platforms (such as vulnerability databases and security vendor threat intelligence platforms) through a pre-defined Application Programming Interface (API) to periodically or in real-time acquire cybersecurity vulnerability data related to the supply chain (such as Common Vulnerabilities and Exposures (CVE) information, zero-day vulnerability alerts, etc.) and attack event data (such as Advanced Persistent Threat Attack Intelligence (APT) attack intelligence, malware samples, etc.). Simultaneously, nodes also collect internal operational data (such as system logs, abnormal behavior records, etc.) and intelligence shared with other nodes, aggregating them to form multi-source supply chain security intelligence data. The collected intelligence data undergoes cleaning processing, including removing duplicate records (such as the same vulnerability reported from multiple sources), filtering irrelevant information (such as general security notices unrelated to supply chain security), and correcting formatting errors. Then, the cleaned intelligence data is converted according to a predefined standard format, unifying field names, data types, and value ranges to form standardized intelligence data for subsequent analysis and processing.

[0093] Regarding data cleaning, the intelligence collected by each node often contains a large amount of noisy data and irrelevant information. For example, data obtained from cybersecurity threat intelligence platforms may contain duplicate records, format errors, or outdated information; monitored open-source community forum discussions may include irrelevant chatter, advertisements, etc.; user feedback may be vague and lack key details. The platform can first perform AI-based data cleaning on this intelligence to remove noisy data, correct format errors, and filter out valid information related to security vulnerabilities and attack events, ensuring that subsequent analysis is based on high-quality data.

[0094] Regarding data standardization, intelligence collected by different nodes varies in format, structure, and representation. For example, enterprise vulnerability information may be structured data containing specific fields, while community forum clues collected by open-source project teams are in free text format. The platform converts this intelligence into a standardized format, defining unified field names, data types, and semantic specifications to facilitate integrated analysis. For instance, all time information is converted into a standard time format, and vulnerability description text undergoes natural language processing operations such as word segmentation and annotation to ensure consistent structure and semantic representation.

[0095] Other standardized processing: Based on the type, source, and importance of the intelligence, pre-processed intelligence is classified and labeled. For example, vulnerability information is classified according to vulnerability type (such as buffer overflow, SQL injection, etc.) and severity (such as high-risk, medium-risk, low-risk); community clues are labeled as potential vulnerability discussions, malicious code submission clues, or other types; and abnormal product operation detected in commercial software is classified according to the software functional modules and user scope that may be affected. Classification and labeling facilitate subsequent targeted intelligence fusion and analysis, improving analysis efficiency and accuracy.

[0096] Step S3: Perform feature extraction processing on the preprocessed standardized intelligence data to obtain structured intelligence feature data.

[0097] In this embodiment, feature extraction processing is performed on the preprocessed standardized intelligence data to obtain structured intelligence feature data. Specifically, this includes: extracting key security features from the preprocessed standardized intelligence data to generate intelligence feature vectors; organizing the intelligence feature vectors in a structured manner to construct intelligence feature data under a unified data structure; and fusing the intelligence feature data according to the key features of each intelligence feature data to obtain structured intelligence feature data.

[0098] Specifically, key security features are extracted from standardized intelligence data, such as vulnerability type, severity, impact scope, and exploitation difficulty, as well as attack methods, target assets, and attack sources. For text-based intelligence descriptions, natural language processing techniques are used to extract keywords and semantic features; for structured data, relevant field values ​​are directly extracted. The extracted features are organized into vectors, with each dimension representing a specific feature. Then, the feature vectors are structured to unify intelligence features from different sources and of different types into a standard data structure, ensuring feature consistency and comparability. Finally, based on the key features of the intelligence (such as CVE numbers, vulnerability fingerprints, etc.), multiple intelligence records describing the same security issue are identified, fused, supplemented with additional information, and conflicting content is eliminated to form complete and accurate structured intelligence feature data.

[0099] Regarding the aforementioned key security features, these features differ depending on the type of intelligence. For example, for vulnerability information intelligence, key features include the vulnerability identifier (such as CVE number), affected system components, vulnerability triggering conditions, and attack consequences; for security vulnerability discussion threads in the community, key features might be specific code snippets, descriptions of abnormal behavior, and keywords related to software versions; for product operation anomaly intelligence, key features are the manifestation of the abnormal phenomenon (such as software crashes, slow response times), the abnormal environment configuration, and user operation steps. These key security features can be learned and identified from a large number of intelligence samples through a combination of manual annotation and machine learning algorithms.

[0100] Regarding the aforementioned structured representation, intelligence content from various sources is structured into a unified data structure, covering types such as vulnerability information, community discussion clues, and product operation anomalies. Fields and attributes are clearly defined, such as vulnerability identifiers, impact scope, and source identifiers, along with format and value range requirements. Missing fields are supplemented with default values ​​or marked as missing according to rules, while redundant fields are temporarily stored in the appendix or discarded. This ensures a complete and standardized structure, providing high-quality structured data for subsequent fusion analysis. The accuracy, completeness, and consistency of the converted data are verified. Through methods such as completeness checks, consistency verification, and accuracy checks, missing or erroneous data is promptly corrected or reverted for re-conversion to guarantee the quality of the structured data.

[0101] Regarding intelligence matching and fusion, vulnerability intelligence with a standard structure can be matched based on key characteristics, such as CVE number, vulnerability code snippet, and vulnerability submission hash. For vulnerabilities in the same match, structural fields are fused. When fields are not unique, they are overwritten according to the priority of the intelligence source. At the same time, the system backend retains information on each merged field for easy manual review and correction. The final result is then included in the intelligence database.

[0102] Step S4: Based on the structured intelligence feature data, use a machine learning model to perform threat assessment and generate supply chain threat assessment results.

[0103] In this embodiment, threat assessment is performed using a machine learning model based on structured intelligence feature data to generate supply chain threat assessment results. Specifically, this includes: using historical intelligence data as training samples to construct a machine learning threat assessment model; inputting structured intelligence feature data into the machine learning threat assessment model to calculate a threat level score; and ranking risks according to the threat level score to generate supply chain threat assessment results.

[0104] Here, historical intelligence data and its corresponding known threat events can be used as training samples to build a machine learning model. A classification algorithm is chosen to determine the threat type corresponding to the intelligence (such as network intrusion, malware attacks, etc.), and a neural network algorithm is used to predict threat levels such as the likelihood of vulnerability exploitation and the potential losses from attack events. During training, the model parameters are continuously adjusted to optimize performance and improve the accuracy of threat assessment for new intelligence. In the application phase, the fused intelligence feature vectors are input into the trained machine learning model for real-time threat assessment. Intelligence can be ranked according to the threat level output by the model, allowing researchers to prioritize and address the most potentially risky intelligence and develop targeted defense strategies.

[0105] Specifically, the architecture of the machine learning threat assessment model includes an input layer, a feature engineering layer, and a model architecture layer. The input layer receives structured intelligence feature data, including vulnerability feature vectors (CVE IDs, Common Vulnerability Scoring System (CVSS) scores, affected components, etc.), attack event features (attack type, time series, scope of impact, etc.), and supply chain node features (node ​​type, importance, connectivity, etc.). The feature engineering layer standardizes and normalizes the input features, uses Principal Component Analysis (PCA) or feature importance ranking for feature selection and dimensionality reduction, and performs one-hot encoding or label encoding on categorical features. The model architecture layer includes classification models (such as Random Forest or XGBoost for threat type classification), regression models (such as Support Vector Regression or Gradient Boosting Regression for risk score prediction), and time series models (such as Long Short-Term Memory (LSTM) networks for threat trend prediction).

[0106] Historical intelligence data and its corresponding actual security incident outcomes (such as whether vulnerabilities were exploited, whether attacks were successful, and the actual losses incurred) are collected as training samples to train a machine learning threat assessment model using supervised learning methods. After the model is trained, new structured intelligence feature data is input into the model to calculate a threat level score. The score considers multiple dimensions, including threat severity, urgency, exploitability, and potential impact on the supply chain. The intelligence is then ranked according to the threat level score, generating a supply chain threat assessment result that includes a list of high-risk threats, risk distribution statistics, and threat trend predictions.

[0107] When building a machine learning threat assessment model, the first step is to collect a large amount of historical intelligence data as training samples. This historical data includes information on known security vulnerabilities, attack records, and the actual impact of these threats on the supply chain. We employ a multi-stage model building approach, combining random forest and gradient boosting decision tree algorithms to improve the accuracy and interpretability of threat assessment.

[0108] In the data preprocessing stage, we cleaned and standardized historical intelligence data, converting unstructured text into structured feature vectors. During feature engineering, we extracted over 200 features from the raw intelligence data, including CVSS score dimensions, vulnerability type encoding, prevalence of affected components, and remediation difficulty coefficients. Through feature importance analysis and correlation screening, we ultimately retained 78 features with significant predictive power. To address the problem of imbalanced datasets (few high-risk threat samples), we employed the Synthetic Minority Oversampling Technique (SMOTE) to generate synthetic minority class samples, enabling the model to better identify high-risk threat patterns.

[0109] The model architecture employs a two-level classification and regression approach. The first level uses a random forest classifier to initially classify threats into three categories: "high-risk," "medium-risk," and "low-risk." The second level trains gradient boosting regression trees for each category to accurately predict the numerical score of the threat. Regarding hyperparameter configuration, the random forest classifier has the following key parameters: the number of trees (n_estimators) is set to 500 to ensure sufficient complexity for capturing threat features; the maximum tree depth (max_depth) is set to 12 to prevent overfitting while maintaining sufficient model expressive power; the feature sampling ratio (max_features) is set to "sqrt," meaning each decision tree randomly selects features equal to the square root of the total number of features, enhancing the model's generalization ability; and the minimum number of leaf node samples (min_samples_leaf) is set to 5 to avoid excessive sensitivity to noise. For gradient boosting regression trees, we set the learning rate to 0.01 to make the model training more stable; the number of trees is 1000, and we use an early stopping strategy (early_stopping_rounds=50) to avoid overfitting; the subsample ratio is 0.8, and 80% of the samples are randomly selected for training in each iteration to further enhance the robustness of the model.

[0110] The training process employed a 5-fold cross-validation method to evaluate model performance, ensuring the reliability of the evaluation results. To optimize hyperparameters, a Bayesian optimization algorithm was used to search for the optimal combination in a predefined parameter space. The objective function was a weighted F1 score, with a particular focus on the accuracy of identifying high-risk threats. During model training, a feature importance feedback mechanism was introduced to dynamically adjust feature weights, making the model pay more attention to features that have a greater impact on threat assessment results. After training, the model achieved an overall accuracy of 87.6% on the test set, a recall rate of 92.3% for high-risk threats, and a false positive rate below 8.5%.

[0111] To enhance the model's usability, we also implemented interpretability features for the threat scoring. Through Shapley Additive exPlanations (SHAP) analysis, the system can provide explanations for key influencing factors for each threat assessment result, such as which features contribute most to the current threat score and the levels of these feature values. This interpretability design allows security analysts to understand the model's decision-making rationale, increasing their confidence in the model's predictions.

[0112] During the deployment phase, we serialize and integrate the trained model into the threat assessment module. When new structured intelligence feature data is input into the system, the model first classifies the threat type and then calculates a precise threat level score (range 0-100). Based on the score results, the system automatically sorts the threats and generates a supply chain threat assessment report that includes threat level, impact scope, and recommended response measures, providing a scientific basis for security decisions.

[0113] In another embodiment, threat assessment based on structured intelligence feature data and using machine learning models to generate supply chain threat assessment results further includes: constructing a deep learning model to extract semantic features from intelligence text and generating semantic feature vectors; establishing a multilayer perceptron model to process the semantic feature vectors and output threat type classification results and risk scores; using an ensemble learning method to combine the prediction results of multiple machine learning models on the semantic feature vectors and calculate the comprehensive threat level; analyzing the threat propagation path based on the supply chain topology and calculating the influence weights between nodes; assessing the potential impact range of the threat on the entire supply chain based on the influence weights; and generating supply chain threat assessment results including propagation analysis based on the potential impact range, threat type classification results, risk scores, and comprehensive threat levels.

[0114] Specifically, the architecture of the deep learning model includes: a text semantic feature extraction model, a code snippet analysis model, and an attack sequence analysis model. The text semantic feature extraction model includes an embedding layer (using Word2Vec or BERT pre-trained word vectors, with a dimension of 512), convolutional layers (multiple 1D convolutional kernels of sizes 3, 4, and 5, used to extract local features), pooling layers (max pooling, extracting the most important features), and fully connected layers (outputting a 128-dimensional semantic feature vector). The code snippet analysis model includes a code transformation layer (converting code into an Abstract Syntax Tree (AST), a graph convolutional network (processing the AST structure and identifying malicious patterns), and an attention mechanism (focusing on key code segments). The attack sequence analysis model includes an LSTM layer (bidirectional LSTM, with 256 hidden units), an attention layer (identifying key time points), and an output layer (predicting the next attack behavior).

[0115] The multilayer perceptron model integrates different types of features, including numerical features (CVSS scores, number of affected nodes, time intervals, etc.), categorical features (threat type, node type, attack method, etc.), textual features (semantic vectors extracted from deep learning models), graph structure features (topological features of the supply chain network, such as degree centrality, betweenness centrality, etc.), and temporal features (attack time patterns, periodic features). The multilayer perceptron architecture consists of an input layer (receiving a concatenated vector of the above five types of features), hidden layer 1 (256 neurons, ReLU activation), hidden layer 2 (128 neurons, ReLU activation), and an output layer (threat type probability distribution and risk score).

[0116] Ensemble learning methods are used to combine the predictions of multiple machine learning models to calculate the overall threat level. Examples of ensemble learning methods include Bagging (training multiple random forest models and voting or averaging the predictions), Boosting (using AdaBoost or XGBoost to progressively correct errors in previous models), and Stacking (using multiple base models such as random forests, support vector machines (SVMs), and neural networks in the first layer, and a meta-learner such as logistic regression to fuse the outputs of the base models in the second layer). The combination method is as follows:

[0117] ,in The weights are determined based on the model's performance on the validation set.

[0118] Based on the supply chain topology analysis, threat propagation paths are analyzed, and the impact weights between nodes are calculated. The potential impact range of the threat on the entire supply chain is assessed based on these impact weights, including the direct impact range (number of supply chain nodes directly affected by the threat, affected business processes and product lines), the indirect impact range (downstream nodes affected due to dependencies, potential business interruption time and economic losses), the propagation impact range (length of the threat's propagation path in the supply chain network, number of potentially affected end users), and the time impact range (duration of the threat's impact, time required to restore normal operations). Based on the potential impact range, threat type classification results, risk scores, and overall threat level, a supply chain threat assessment result including propagation analysis is generated.

[0119] Step S5: Based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes.

[0120] In this embodiment, based on the supply chain threat assessment results and user attribute information, personalized push processing is adopted to push customized early warning information to the corresponding supply chain nodes. Specifically, this includes: obtaining user role type, business focus, and risk tolerance as user attribute information; calculating a matching score using a personalized recommendation algorithm based on the user attribute information and the supply chain threat assessment results; and generating differentiated early warning content based on the matching score and the threat urgency indicated by the supply chain threat assessment results, thus forming customized early warning information.

[0121] Specifically, user attribute information is collected and maintained, including user role type (e.g., security operations personnel, developers, management decision-makers), business concerns (e.g., code security, system stability, compliance), and risk tolerance (e.g., high-risk sensitive, balanced, risk-tolerant). Regarding business concerns, different user types have different focuses. For example, enterprise users may be more concerned with open-source components actually used within their business, while open-source organization users may be more concerned with projects within their organization (e.g., malicious operations after developer accounts are stolen) and dependent downstream projects (e.g., malware infection). In implementation, a SBOM (Simplified Business Object Model) can be used to record component-related information (e.g., component version, license agreement, known vulnerabilities). Specifically, the component-related information in the SBOM can be associated with the enterprise's business systems to determine the role and importance of each component in the business process. For open-source components actually used within the business, if they have high-risk vulnerabilities, the business scope and functional modules that the vulnerabilities may affect can be determined by analyzing the component's dependencies, thereby more accurately assessing the degree of risk impact and affecting the matching score below.

[0122] Based on user attribute information and supply chain threat assessment results, personalized recommendation algorithms (such as collaborative filtering and content matching) are used to calculate a matching score between each threat intelligence and the user, assessing the relevance and importance of the intelligence to a specific user. According to the matching score and the urgency of the threat, the priority and push method of the alert are determined (such as instant push, periodic aggregation, etc.). Furthermore, based on the user's role and concerns, the level of detail and technical depth of the alert content is customized to form personalized alert information for different users.

[0123] In an optional implementation, threat intelligence can first undergo multi-terminal cross-independent verification to reduce false positives and malicious delivery. Specifically, for example, for threat intelligence from multiple different intelligence sources, the core information (such as intelligence credibility score) can be compared to verify the authenticity of the intelligence. For example, threat intelligence with credibility scores differing by more than a set threshold, intelligence not included in some sources, or contradictory vulnerability descriptions (such as source A stating "requires administrator privileges to trigger," while source B states "remote trigger without privileges") can be filtered.

[0124] In another embodiment, based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes. This further includes: determining the node weight coefficient of each supply chain node based on its business scale and technical capabilities; weighting and fusing the intelligence data provided by each supply chain node based on the node weight coefficient to calculate a weighted credibility score; fusing and analyzing the intelligence from multiple supply chain nodes regarding the same threat to generate fused threat intelligence; calculating the impact chain of threat propagation based on the fused threat intelligence and analyzing the business dependencies between nodes; and generating customized early warning information for each node based on the impact chain, taking into account upstream and downstream impacts.

[0125] Specifically, the credibility and importance of each node in the supply chain are assessed based on its business scale (such as annual revenue and number of employees) and technical capabilities (such as the size of the technical team and security investment), and a node weighting coefficient is determined. Based on this node weighting coefficient, the intelligence data provided by each node is weighted and fused to calculate a weighted credibility score for each piece of intelligence, thereby increasing the influence of intelligence provided by high-credibility nodes in decision-making.

[0126] This process involves fusing and analyzing intelligence from multiple supply chain nodes regarding the same threat to generate fused threat intelligence. The fusion analysis employs various methods, including evidence-theoretic fusion (using Dempster-Shafer theory, treating intelligence from different nodes as evidence sources, and calculating the confidence and likelihood of each threat hypothesis), Bayesian fusion (constructing a Bayesian network model, using node confidence as a prior probability, and updating the posterior probability of the threat's existence), weighted average fusion (fusion confidence = Σ(node ​​weightᵢ × intelligence confidenceᵢ) / Σ node weightᵢ), and consistency testing (calculating the similarity of intelligence from different nodes, identifying conflicting information, and resolving conflicts). The fusion process includes collecting multi-source intelligence on the same threat, standardizing intelligence formats and evaluation metrics, applying fusion algorithms to calculate a comprehensive evaluation, and generating final intelligence containing confidence ranges.

[0127] Based on the fused threat intelligence, the propagation paths and impact range of threats within the supply chain network are analyzed, nodes potentially affected by cascading effects are identified, and the impact chains of threat propagation are calculated. Business dependencies between nodes are analyzed, and the potential impact of upstream nodes being affected by threats on downstream nodes is assessed. Based on the impact chain analysis results, customized early warning information considering upstream and downstream impacts is generated for each node, helping nodes understand not only threats directly related to themselves but also threats that may indirectly affect them through supply chain relationships.

[0128] For example, after considering personalized information such as user roles and subscription settings, risk intelligence can be pushed to relevant users in different forms. For instance, core enterprises can receive detailed risk assessment reports and response suggestions, open source project teams can receive requests for vulnerability remediation collaboration, and commercial software vendors can receive product investigation warnings.

[0129] Step S6: Collect user feedback data on the customized early warning information, optimize and adjust the machine learning model, and update the intelligence collection strategy configuration.

[0130] Here, after receiving a warning, users will take appropriate measures (such as fixing vulnerabilities or adjusting configurations) and provide feedback on the accuracy of the warning. Based on the feedback data, the platform optimizes the feature weights of the machine learning model to improve the accuracy of identifying risks associated with similar open-source components; at the same time, it adjusts its intelligence gathering strategy, such as increasing the frequency of intelligence collection from open-source communities and related commercial software vendors, to create a continuously improving intelligence warning service.

[0131] In practice, user feedback data on customized early warning information is collected to optimize and adjust the machine learning model and update the intelligence gathering strategy configuration. Specifically, this includes: collecting user ratings on the accuracy and relevance of early warnings through the feedback interface and statistically analyzing the early warning response effect; adjusting the machine learning model parameters based on the feedback data using the gradient descent algorithm and retraining the threat assessment model; dynamically adjusting the frequency and scope of intelligence gathering based on false alarms and missed alarms in the feedback; establishing a feedback evaluation index system to calculate the model optimization effect, and applying new model parameters when the accuracy improvement exceeds a set threshold.

[0132] Specifically, a feedback interface is set up in the early warning information push interface or system to collect user evaluations of the early warnings, including accuracy scores (whether the early warning accurately identified a real threat), relevance scores (whether the early warning is relevant to the user's business), and the response measures taken by the user and their effects. The feedback data is statistically analyzed to calculate evaluation indicators such as the early warning's accuracy, recall, and F1 score, identifying the model's strengths and weaknesses. Based on the feedback data, optimization algorithms such as gradient descent are used to adjust the parameters of the machine learning model, such as feature weights and decision thresholds, and the model is retrained using new labeled data to improve the model's predictive accuracy. False positives (warnings about threats that do not actually exist) and false negatives (warnings about threats that do not actually exist) in the feedback are analyzed to identify the causes of the errors, such as insufficient identification of specific types of threats or quality issues with certain intelligence sources. Based on the analysis results, intelligence collection strategies are dynamically adjusted, such as increasing the frequency of collection from high-quality intelligence sources, reducing the weight of low-quality intelligence sources, and expanding or narrowing the scope of collection for specific types of intelligence. Establish an evaluation system that includes metrics such as accuracy, recall, and user satisfaction. Calculate the model optimization effect regularly. When the accuracy of the optimized model on the test set improves by more than a preset threshold (such as 5%), apply the new model parameters to the production environment to achieve continuous model optimization and iteration.

[0133] Based on the above description, the embodiments of this disclosure can achieve: efficient intelligence sharing: eliminating information silos through a distributed architecture, realizing real-time sharing and collaborative analysis of intelligence across the supply chain, breaking down barriers to traditional intelligence sharing mechanisms, and improving the efficiency of intelligence flow; accurate risk warning: based on machine learning models and dynamic analysis mechanisms, it can accurately identify potential security risks in the supply chain, provide customized warning information, effectively reduce false alarms and false negatives, help users take countermeasures in advance, and avoid the spread of risks; dynamic self-optimization: the feedback and optimization closed-loop mechanism enables the system to continuously improve based on user feedback, constantly improve the accuracy of warnings and the rationality of intelligence collection strategies, adapt to the ever-changing security situation of the supply chain, and form a sustainable warning ecosystem; enhanced supply chain resilience: personalized, timely, and accurate intelligence push helps all participants in the supply chain to respond quickly to security threats, collaboratively repair vulnerabilities, reduce the impact of risks on the supply chain, and enhance the resilience and stability of the entire supply chain in the face of complex security environments.

[0134] This disclosure also provides a supply chain security intelligence push and early warning device based on a distributed architecture, such as... Figure 4 As shown, it includes: a distributed architecture construction module, an intelligence preprocessing module, a feature extraction module, a threat assessment module, a personalized push module, and a feedback optimization module. The functions of each module correspond one-to-one with the corresponding steps in the above method, and will not be elaborated further here.

[0135] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

[0136] The modules described above can be implemented using hardware circuits or by running software code on a processor. In the software implementation, each module corresponds to a different functional part of a computer program, and its function is achieved by the processor executing the corresponding program code. In the hardware implementation, each module can be implemented using application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices.

[0137] like Figure 5As shown in the embodiments of this disclosure, a computer device, also known as another supply chain security intelligence push and early warning device, can be deployed on an intelligence platform. It includes a processor 51 and a memory 52. ​​The memory 52 stores machine-readable instructions executable by the processor 51. The processor 51 executes the machine-readable instructions stored in the memory 52. ​​When the machine-readable instructions are executed by the processor 51, the processor 51 performs the steps of the supply chain security intelligence push and early warning method described above, such as: acquiring multi-source supply chain security intelligence data provided by various distributed intelligence nodes; performing preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data; performing feature extraction processing on the preprocessed standardized intelligence data to obtain structured intelligence feature data; using a machine learning model to perform threat assessment based on the structured intelligence feature data to generate a supply chain threat assessment result; using personalized push processing based on the supply chain threat assessment result and user attribute information to push customized early warning information to the corresponding supply chain nodes; collecting user feedback data on the customized early warning information; optimizing and adjusting the machine learning model; and updating the intelligence collection strategy configuration.

[0138] The aforementioned memory 52 includes a main memory 521 and an external memory 522; the main memory 521, also known as internal memory, is used to temporarily store the computational data in the processor 51, as well as the data exchanged with external memory 522 such as a hard disk. The processor 51 exchanges data with the external memory 522 through the main memory 521.

[0139] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the external memory dynamic management method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0140] Furthermore, this disclosure also provides a computer program product storing a computer program. When the computer program is run by a processor, it executes the steps of the external memory dynamic management method provided in any of the above embodiments of this disclosure. For details, please refer to the above method embodiments, which will not be repeated here.

[0141] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium, which can be a volatile or non-volatile computer-readable storage medium. In another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0142] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices and apparatuses described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0143] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0144] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0145] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0146] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A supply chain security intelligence push alerting method, characterized in that, include: Construct a distributed supply chain intelligence network architecture, and deploy distributed intelligence nodes at each key node of the supply chain intelligence network architecture; Acquire multi-source supply chain security intelligence data provided by each distributed intelligence node, and perform preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data. The preprocessed standardized intelligence data is subjected to feature extraction processing to obtain structured intelligence feature data; Based on the structured intelligence feature data, a machine learning model is used to conduct threat assessment and generate supply chain threat assessment results. Based on the supply chain threat assessment results and user attribute information, personalized push processing is used to push customized early warning information to the corresponding supply chain nodes; Collect user feedback data on the customized early warning information, optimize and adjust the machine learning model, and update the intelligence collection strategy configuration; The construction of a distributed supply chain intelligence network architecture, including the deployment of distributed intelligence nodes at key nodes of the supply chain intelligence network architecture, includes: Identify the core enterprises, open-source project teams, and commercial software vendor nodes in the supply chain intelligence network architecture, classify the nodes, and determine the deployment location, quantity, and type of each distributed node based on the classification results; Distributed intelligence node devices are installed at the locations where the distributed nodes are deployed to establish high-speed network links between supply chain nodes. Based on the high-speed network link connection, a distributed message passing mechanism is constructed; the distributed message passing mechanism is used to asynchronously transmit intelligence data between various supply chain nodes through a message queue mechanism; The step of using personalized push processing based on the supply chain threat assessment results and user attribute information to push customized early warning information to the corresponding supply chain nodes includes: The node weight coefficient of each supply chain node is determined based on the business scale and technical capabilities of each node. Based on the node weight coefficients, the intelligence data provided by each supply chain node are weighted and fused to calculate a weighted credibility score. Based on the weighted credibility score, intelligence from multiple supply chain nodes regarding the same threat is fused and analyzed to generate fused threat intelligence. The fusion analysis process includes collecting multi-source intelligence on the same threat, standardizing intelligence formats and evaluation indicators, applying fusion algorithms to calculate a comprehensive evaluation, and generating fused threat intelligence containing credibility ranges. Based on the fused threat intelligence, calculate the impact chain of threat propagation and analyze the business dependencies between nodes; Obtain user role type, business focus, and risk tolerance as user attribute information; Based on the user attribute information and supply chain threat assessment results, a matching score is calculated using a personalized recommendation algorithm; Based on the matching score and the threat urgency indicated by the supply chain threat assessment results, differentiated early warning content is generated, and customized early warning information considering upstream and downstream impacts is generated for each node based on the business dependencies between nodes.

2. The method according to claim 1, characterized in that, Acquire multi-source supply chain security intelligence data provided by various distributed intelligence nodes, and perform preprocessing operations on the multi-source supply chain security intelligence data to obtain preprocessed standardized intelligence data, including: Each distributed intelligence node connects to an external threat intelligence platform via API interface to obtain network security vulnerability data and attack event data, which are then aggregated to form the multi-source supply chain security intelligence data. The multi-source supply chain security intelligence data is cleaned to remove duplicate records and irrelevant information; The cleaned intelligence data is standardized and transformed to obtain the preprocessed standardized intelligence data.

3. The method according to claim 1, characterized in that, The preprocessed standardized intelligence data is subjected to feature extraction processing to obtain structured intelligence feature data, including: Key security features are extracted from the preprocessed standardized intelligence data to generate an intelligence feature vector. The intelligence feature vectors are organized in a structured manner to construct intelligence feature data under a unified data structure; Based on the key features of each intelligence feature data, the intelligence feature data is fused to obtain the structured intelligence feature data.

4. The method according to claim 1, characterized in that, Based on the structured intelligence feature data, a machine learning model is used to perform threat assessment, generating supply chain threat assessment results, including: Historical intelligence data is used as training samples to build a machine learning threat assessment model; The structured intelligence feature data is input into the machine learning threat assessment model to calculate the threat level score; The supply chain threat assessment results are generated by ranking risks based on the threat level scores.

5. The method according to claim 1, characterized in that, Based on the structured intelligence feature data, a machine learning model is used to perform threat assessment and generate supply chain threat assessment results, which also includes: Construct a deep learning model to extract semantic features from intelligence texts and generate semantic feature vectors; A multilayer perceptron model is established to process the semantic feature vectors and output threat type classification results and risk scores. An ensemble learning approach is used to combine the prediction results of multiple machine learning models on the semantic feature vector to calculate the overall threat level. Based on supply chain topology analysis, the threat propagation path is analyzed, and the influence weights between nodes are calculated. The potential impact range of the threat on the entire supply chain is assessed based on the impact weight. Based on the potential impact range, the threat type classification results, the risk score, and the comprehensive threat level, the supply chain threat assessment results including propagation analysis are generated.

6. The method according to claim 1, characterized in that, Collect user feedback data on the customized early warning information, optimize and adjust the machine learning model, and update the intelligence gathering strategy configuration, including: The system collects user ratings on the accuracy and relevance of alerts through a feedback interface. Based on the scoring data, the parameters of the machine learning model were adjusted using the gradient descent algorithm, and the threat assessment model was retrained. Based on the false alarms and omissions reported in the feedback, the frequency and scope of intelligence gathering will be dynamically adjusted. Establish a feedback evaluation index system to calculate the optimization effect of the model, and apply new model parameters when the accuracy improvement exceeds the set threshold.

7. A computer device, characterized in that, It includes a processor and a memory, the memory being used to store computer program instructions, and the processor being used to execute the computer program instructions to perform the supply chain security intelligence push and early warning method according to any one of claims 1 to 6.

Images