Supply chain cross-package vulnerability detection method and device, equipment and storage medium

Abstract

The present application relates to the technical field of information processing, and more particularly to a supply chain cross-package vulnerability detection method, device and equipment and storage medium, by integrating the vulnerability package name, sensitive API, trigger parameter and vulnerability description into a four-tuple information, when the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file, the cross-package chain reachability analysis algorithm is used to analyze the cross-package call chain of the source code file, the function call sequence of the sensitive API is obtained based on the cross-package call chain analysis result, the vulnerability detection of the cross-package call chain is realized, the preset large language model is used to generate vulnerability verification code based on the four-tuple information, and the reachability of the vulnerability verification code is verified in the function call sequence, the vulnerability confidence is determined according to the energy consumption of the large language model, when the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high, the vulnerability alarm information is generated, the double determination of the vulnerability is realized, the false positive rate of the vulnerability is reduced, and the user satisfaction is improved.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method, apparatus, device, and storage medium for detecting cross-package vulnerabilities in the supply chain. Background Technology

[0002] Python is a high-level, general-purpose interpreted programming language. Due to its rich collection of third-party libraries, it is favored by many developers, which has led to the formation of the Python package index (PyPi) ecosystem. Package developers can upload packages to the PyPi repository, and package users can download the Python packages they need from the PyPi repository. This ecosystem has been developed in a way that is convenient for users, but it has also provided opportunities for attackers.

[0003] As the number of Python packages increases and the PyPi ecosystem grows larger, so too does the number of Python-related vulnerabilities. Furthermore, the extensive and complex dependencies between Python packages mean that these vulnerabilities are no longer limited to the Python package from which they are discovered, but also affect dependent Python packages and applications within the Python package supply chain. Therefore, the PyPi ecosystem is facing serious threats from Python vulnerabilities. Existing tools such as pip-aduit and Safety are command-line tools used to scan the Python environment for known security vulnerabilities, but they only detect package-level vulnerabilities and cannot detect code within packages, resulting in a high false positive rate. Function-level methods like PyVul++ are limited to single-package calls and cannot analyze cross-package call chains, reducing user satisfaction. Summary of the Invention

[0004] In order to overcome the shortcomings of the prior art, the purpose of this invention is to provide a supply chain cross-package vulnerability detection method, apparatus, device and storage medium that can detect vulnerabilities in cross-package call chains, reduce the false alarm rate of vulnerabilities and improve user satisfaction.

[0005] The first aspect of this invention provides a method for detecting cross-package vulnerabilities in a supply chain, comprising: obtaining the source code file and dependency declaration file of a target project; obtaining the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from CVE announcement text or links; extracting sensitive APIs and trigger parameters corresponding to the sensitive APIs from the vulnerability descriptions; integrating the vulnerability package name, the sensitive APIs, the trigger parameters, and the vulnerability descriptions into a four-tuple; determining whether the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file; if so, performing cross-package call chain analysis on the source code file using a cross-package call chain analysis algorithm to obtain a cross-package call chain analysis result; obtaining the function call sequence of the sensitive API based on the cross-package call chain analysis result; generating vulnerability verification code based on the four-tuple information using a preset large language model; verifying the reachability of the vulnerability verification code in the function call sequence to obtain a reachability verification result; determining the vulnerability confidence level based on the energy consumption of the large language model; and generating vulnerability alert information when the reachability verification result indicates that the vulnerability is reachable and the vulnerability confidence level is high confidence level.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the step of obtaining the source code file and dependency declaration file of the target project, and obtaining the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link, includes: obtaining the source code file and dependency declaration file of the target project; obtaining the CVE announcement text or link from the official CVE website or a third-party vulnerability database using web crawling technology; parsing the CVE announcement text or link using natural language processing technology, and extracting the vulnerability package name and the vulnerability description corresponding to the vulnerability package name; removing HTML tags, special characters, and redundant information from the vulnerability description, wherein the redundant information includes duplicate content, advertising information, and copyright notices.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of extracting sensitive APIs and corresponding trigger parameters from the vulnerability description, and integrating the vulnerability package name, the sensitive APIs, the trigger parameters, and the vulnerability description into a four-tuple information, includes: using a BERT-based natural language processing model to identify function names, method names, class names, or attribute names in the vulnerability description text as sensitive APIs; extracting parameter names, parameter values, parameter types, or trigger conditions mentioned in the vulnerability description as trigger parameters through dependency parsing and named entity recognition technology; integrating the vulnerability package name, the sensitive APIs, the trigger parameters, and the vulnerability description into a four-tuple information according to a preset structured format, and storing the four-tuple information in a structured database.

[0008] Optionally, in a third implementation of the first aspect of the present invention, determining whether the vulnerability package corresponding to the quadruple information exists in the dependency declaration file, and if so, performing cross-package call chain analysis on the source code file using a cross-package call chain analysis algorithm to obtain the cross-package call chain analysis result, includes: traversing all dependency package names in the dependency declaration file and performing string matching between the dependency package name and the vulnerability package name in the quadruple information; when the matching is successful, converting the source code file into an abstract syntax tree; identifying function definition nodes, class definition nodes, and function call nodes in the abstract syntax tree; and constructing a cross-package function call graph using data flow analysis based on the function definition nodes, class definition nodes, and function call nodes as the cross-package call chain analysis result.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, the step of obtaining the function call sequence of the sensitive API based on the cross-package call chain analysis result, generating vulnerability verification code based on the quadruple information using a preset large language model, and verifying the reachability of the vulnerability verification code in the function call sequence to obtain a reachability verification result includes: searching for all reachable paths from the project entry point to the sensitive API in the cross-package call chain analysis result using a depth-first search algorithm to obtain the function call sequence of the sensitive API; inputting the quadruple information as a prompt word into the preset large language model to enable the large language model to generate vulnerability verification code; verifying the reachability of the vulnerability verification code in the function call sequence using the large language model, and outputting the reachability verification result.

[0010] Optionally, in the fifth implementation of the first aspect of the present invention, the step of determining the vulnerability confidence based on the energy consumption of the large language model, and generating vulnerability alarm information when the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high confidence, includes: when the reachability verification result is that the vulnerability is reachable, statistically analyzing the energy consumption of the large language model; determining whether the energy consumption is greater than a preset energy consumption threshold; if not, determining the vulnerability confidence as high confidence and generating vulnerability alarm information.

[0011] Optionally, in the sixth implementation of the first aspect of the present invention, after determining the vulnerability confidence based on the energy consumption of the large language model, and generating vulnerability alarm information when the reachability verification result indicates that the vulnerability is reachable and the vulnerability confidence is high confidence, the method further includes: sending the vulnerability alarm information to a management terminal; generating a vulnerability detection report, the vulnerability detection report including quadruple information, function call sequence, reachability verification result, vulnerability confidence, and remediation suggestions, the remediation suggestions being determined based on vulnerability description and historical remediation strategies; encrypting the vulnerability detection report to obtain an encrypted vulnerability detection report; and uploading the encrypted vulnerability detection report to the blockchain.

[0012] A second aspect of this invention provides a supply chain cross-package vulnerability detection device, comprising: an acquisition module, configured to acquire the source code file and dependency declaration file of a target project, and acquire the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from CVE announcement text or links; an extraction and integration module, configured to extract sensitive APIs and trigger parameters corresponding to the sensitive APIs from the vulnerability descriptions, and integrate the vulnerability package name, the sensitive APIs, the trigger parameters, and the vulnerability description into a four-tuple of information; and a judgment and analysis module, configured to determine whether the vulnerability package corresponding to the four-tuple of information exists in the dependency declaration file, and if so, to utilize... A cross-package call chain reachability analysis algorithm performs cross-package call chain analysis on the source code file to obtain cross-package call chain analysis results; an acquisition and generation verification module is used to obtain the function call sequence of the sensitive API based on the cross-package call chain analysis results, generate vulnerability verification code based on the four-tuple information using a preset large language model, and verify the reachability of the vulnerability verification code in the function call sequence to obtain reachability verification results; a determination generation module is used to determine the vulnerability confidence based on the energy consumption of the large language model, and generate vulnerability alarm information when the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high confidence.

[0013] Optionally, in a first implementation of the second aspect of the present invention, the acquisition module includes: a first acquisition unit, used to acquire the source code file and dependency declaration file of the target project; a second acquisition unit, used to acquire CVE announcement text or links from the official CVE website or a third-party vulnerability database using web crawling technology; a parsing and extraction unit, used to parse the CVE announcement text or links using natural language processing technology, and extract the vulnerability package name and the vulnerability description corresponding to the vulnerability package name; and a removal unit, used to remove HTML tags, special characters, and redundant information from the vulnerability description, wherein the redundant information includes duplicate content, advertising information, and copyright notices.

[0014] Optionally, in a second implementation of the second aspect of the present invention, the extraction and integration module includes: a first identification unit, used to identify function names, method names, class names, or attribute names in the vulnerability description text as sensitive APIs using a BERT-based natural language processing model; an extraction unit, used to extract parameter names, parameter values, parameter types, or triggering conditions mentioned in the vulnerability description as triggering parameters through dependency parsing and named entity recognition technology; and an integration unit, used to integrate the vulnerability package name, the sensitive APIs, the triggering parameters, and the vulnerability description into a four-tuple information according to a preset structured format, and store the four-tuple information in a structured database.

[0015] Optionally, in a third implementation of the second aspect of the present invention, the judgment and analysis module includes: a traversal matching unit, used to traverse all dependency package names of the dependency declaration file and perform string matching between the dependency package names and the vulnerability package names in the four-tuple information; a conversion unit, used to convert the source code file into an abstract syntax tree when the matching is successful; a second identification unit, used to identify function definition nodes, class definition nodes, and function call nodes in the abstract syntax tree; and a construction unit, used to construct a cross-package function call graph as the cross-package call chain analysis result based on the function definition nodes, class definition nodes, and function call nodes using data flow analysis.

[0016] Optionally, in a fourth implementation of the second aspect of the present invention, the acquisition and generation verification module includes: a search unit, configured to search for all reachable paths from the project entry point to the sensitive API in the cross-package call chain analysis results based on a depth-first search algorithm, to obtain the function call sequence of the sensitive API; an input unit, configured to input the quadruple information as prompt words into a preset large language model, so that the large language model generates vulnerability verification code; and a verification output unit, configured to use the large language model to verify the reachability of the vulnerability verification code in the function call sequence, and output the reachability verification result.

[0017] Optionally, in a fifth implementation of the second aspect of the present invention, the determination generation module includes: a statistics unit, used to count the energy consumption of the large language model when the reachability verification result is that the vulnerability is reachable; a judgment unit, used to judge whether the energy consumption is greater than a preset energy consumption threshold; and a determination generation unit, used to determine the vulnerability confidence as high confidence and generate vulnerability alarm information if not.

[0018] Optionally, in the sixth implementation of the second aspect of the present invention, the method further includes: a sending module for sending the vulnerability alert information to a management terminal; a generation module for generating a vulnerability detection report, the vulnerability detection report including four-tuple information, function call sequence, reachability verification result, vulnerability confidence, and remediation suggestions, the remediation suggestions being determined based on vulnerability description and historical remediation strategies; an encryption module for encrypting the vulnerability detection report to obtain an encrypted vulnerability detection report; and an uploading module for uploading the encrypted vulnerability detection report to a blockchain.

[0019] A third aspect of the present invention provides a supply chain cross-package vulnerability detection device, the supply chain cross-package vulnerability detection device comprising: a memory and at least one processor, the memory storing instructions; the at least one processor invokes the instructions in the memory to cause the supply chain cross-package vulnerability detection device to execute the various steps of the supply chain cross-package vulnerability detection method described in any of the preceding claims.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the supply chain cross-packet vulnerability detection method described in any of the preceding claims.

[0021] In the technical solution of this invention, the vulnerability package name, sensitive API, trigger parameters, and vulnerability description are integrated into a four-tuple of information. When the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file, the cross-package chain reachability analysis algorithm is used to perform cross-package call chain analysis on the source code file. Based on the cross-package call chain analysis results, the function call sequence of the sensitive API is obtained, thereby realizing vulnerability detection of the cross-package call chain. A vulnerability verification code is generated based on the four-tuple information using a preset large language model, and the reachability of the vulnerability verification code is verified in the function call sequence. The vulnerability confidence is determined according to the energy consumption of the large language model. When the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high, a vulnerability alarm message is generated, thereby realizing dual judgment of the vulnerability, reducing the false alarm rate of the vulnerability, and improving user satisfaction. Attached Figure Description

[0022] Figure 1 This is a first flowchart of a supply chain cross-package vulnerability detection method provided in an embodiment of the present invention;

[0023] Figure 2 This is a second flowchart of the supply chain cross-package vulnerability detection method provided in an embodiment of the present invention;

[0024] Figure 3 This is a third flowchart of the supply chain cross-package vulnerability detection method provided in the embodiments of the present invention;

[0025] Figure 4This is a fourth flowchart of the supply chain cross-package vulnerability detection method provided in this embodiment of the invention;

[0026] Figure 5 A schematic diagram of a supply chain cross-package vulnerability detection device provided in an embodiment of the present invention;

[0027] Figure 6 This is another structural schematic diagram of the supply chain cross-package vulnerability detection device provided in an embodiment of the present invention;

[0028] Figure 7 This is a schematic diagram of the supply chain cross-package vulnerability detection device provided in an embodiment of the present invention. Detailed Implementation

[0029] This invention provides a method, apparatus, device, and storage medium for detecting cross-package vulnerabilities in the supply chain, which can detect vulnerabilities in cross-package call chains, reduce the false alarm rate of vulnerabilities, and improve user satisfaction.

[0030] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the supply chain cross-package vulnerability detection method in this invention includes:

[0032] 101. Obtain the source code files and dependency declaration files of the target project, and obtain the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link;

[0033] In this embodiment, source code files and dependency declaration files are obtained from the target project repository through a file system interface or version control tool. At the same time, CVE announcement text or links are periodically crawled from the official CVE website or third-party vulnerability databases using web crawling technology (such as using the Scrapy framework). Natural language processing technology (such as regular expressions or BERT-based parsing models) is used to parse the announcement content, extract the vulnerability package name and corresponding vulnerability description, and remove HTML tags and special characters to ensure data purity.

[0034] 102. Extract the sensitive API and the corresponding trigger parameters from the vulnerability description, and integrate the vulnerability package name, sensitive API, trigger parameters and vulnerability description into a four-tuple of information;

[0035] In this embodiment, a BERT-based natural language processing model is used to segment and encode the vulnerability description text. Function names, method names, class names, or attribute names are identified as sensitive APIs through sequence labeling or named entity recognition technology. At the same time, trigger parameters, including parameter names, parameter values, parameter types, or trigger conditions, are extracted through dependency parsing (such as using Stanford Parser) and named entity recognition. Finally, the vulnerability package name, sensitive APIs, trigger parameters, and vulnerability description are integrated into a four-tuple information according to a preset structured format (such as JSON) and stored in a structured database (such as MySQL) for subsequent retrieval and analysis.

[0036] 103. Determine whether the vulnerability package corresponding to the quadruple information exists in the dependency declaration file. If so, use the cross-packet chain reachability analysis algorithm to perform cross-packet call chain analysis on the source code file and obtain the cross-packet call chain analysis results.

[0037] In this embodiment, all dependency package names in the dependency declaration file are traversed and matched with the vulnerability package names in the four-tuple information (e.g., exact match or fuzzy match). When a match is successful, a parsing tool (e.g., Python's ast module) is used to convert the source code file into an abstract syntax tree (AST). Then, the function definition nodes, class definition nodes, and function call nodes in the AST are identified. Based on these nodes, data flow analysis techniques (e.g., constructing a control flow graph) are used to construct a cross-package function call graph, which serves as the result of the cross-package call chain analysis, covering cross-module and cross-package call relationships.

[0038] 104. Based on the cross-package call chain analysis results, obtain the function call sequence of sensitive APIs, use the preset large language model to generate vulnerability verification code based on the four-tuple information, and verify the reachability of the vulnerability verification code in the function call sequence to obtain the reachability verification result.

[0039] In this embodiment, based on the cross-package call chain analysis results (i.e., function call graph), a depth-first search algorithm is used to find all reachable paths to the sensitive API starting from the project entry point (such as the main function or module initialization point), obtaining the function call sequence of the sensitive API. Then, the quadruple information is input as a prompt word into a preset large language model (such as GPT-4 or Codex) to generate vulnerability verification code (such as test cases or attack vectors). Finally, the reachability of the vulnerability verification code is verified in the function call sequence through static analysis or dynamic simulation, the reachability verification result (success or failure) is output, and detailed path information is recorded.

[0040] 105. Determine the vulnerability confidence level based on the energy consumption of the large language model. When the reachability verification result shows that the vulnerability is reachable and the vulnerability confidence level is high, generate vulnerability alert information.

[0041] In this embodiment, when the reachability verification result indicates that the vulnerability is reachable, the system statistically analyzes the energy consumption of the large language model, such as computational resource consumption (CPU / GPU time, memory usage, power consumption) or inference time (response latency). The energy consumption reflects the smoothness and determinism of the model's generation of verification code. Low energy consumption usually indicates that the model can easily and deterministically generate verification code, and its output reliability is high. High energy consumption, on the other hand, indicates that the model encountered confusion or ambiguity when processing requests, and performed complex internal inference. The generated code may have problems or uncertainties. The system determines whether the energy consumption is less than a preset energy consumption threshold (based on historical data, model characteristics, or experimental settings). If the energy consumption is lower than the threshold, it indicates that the model output is reliable, the vulnerability confidence is determined to be high confidence, and a vulnerability alarm message is generated. This achieves dual vulnerability determination, based on reachability verification and high reliability confidence assessment, effectively reducing the false positive rate of vulnerabilities and improving detection accuracy.

[0042] In this embodiment of the invention, vulnerability information is automatically extracted and structured into quadruplets from CVE announcements. When the vulnerable package exists in the target project's dependencies, a cross-package chain reachability analysis algorithm is used to construct a cross-package function call graph to identify potential vulnerability propagation paths. Then, based on a large language model, the reachability of vulnerability verification code is generated and verified. Combined with the model's energy consumption, the vulnerability confidence is dynamically evaluated. This realizes a progressive, dual-judgment vulnerability detection mechanism from "dependency existence" to "code reachability" and then to "high-confidence verification". It effectively solves the key pain points of existing tools that can only perform package-level detection, resulting in a high false positive rate, and function-level methods that cannot analyze cross-package call chains, resulting in missed detections and misjudgments. It significantly improves the accuracy and practicality of vulnerability detection in complex supply chain environments.

[0043] Please see Figure 2 In the second embodiment of the supply chain cross-package vulnerability detection method of the present invention, steps 101 and 102 include:

[0044] 201. Obtain the source code files and dependency declaration files of the target project;

[0045] In this embodiment, source code files and dependency declaration files are obtained from the target project repository through a file system interface or version control tool.

[0046] 202. Obtain CVE announcement text or links from the official CVE website or third-party vulnerability databases using web scraping techniques;

[0047] In this embodiment, a distributed crawler system is built using web crawler frameworks such as Scrapy and BeautifulSoup. The system periodically crawls security announcements from the official CVE website and mainstream third-party vulnerability databases. The crawler system supports incremental crawling, deduplication, and bypassing anti-crawler mechanisms, enabling it to efficiently obtain the latest vulnerability information. At the same time, an automatic update mechanism for vulnerability information is established to ensure the timeliness of the vulnerability database and provide continuous data support for real-time vulnerability detection.

[0048] 203. Use natural language processing technology to parse the CVE announcement text or link, and extract the vulnerability package name and the vulnerability description corresponding to the vulnerability package name;

[0049] In this embodiment, a Transformer-based natural language processing model (such as BERT, RoBERTa, etc.) is applied to perform deep semantic parsing on CVE announcements. Sequence labeling and relation extraction techniques are used to identify the specific software package names affected by the vulnerability. At the same time, text classification and key information extraction algorithms are used to extract a structured vulnerability description from the announcement. The vulnerability description includes key elements such as vulnerability type, scope of impact, attack vector, and security impact.

[0050] 204. Remove HTML tags, special characters, and redundant information from the vulnerability description. Redundant information includes duplicate content, advertising information, and copyright notices.

[0051] In this embodiment, HTML parsing libraries (such as lxml and html.parser) are used to remove HTML tags and style information from the announcements, and special characters (such as newline characters and tab characters) are filtered using regular expressions. At the same time, text cleaning algorithms are applied to remove noisy data such as duplicate content, advertising information, and copyright notices, ensuring the purity and usability of the extracted vulnerability description information.

[0052] 205. Use a BERT-based natural language processing model to identify function names, method names, class names, or attribute names in vulnerability description text as sensitive APIs;

[0053] In this embodiment, a BERT model pre-trained on the code corpus is loaded to perform word segmentation, encoding, and sequence labeling on the cleaned vulnerability description text, identify programming language elements, and accurately locate sensitive APIs such as function names, method names, class names, and attribute names through named entity recognition technology.

[0054] 206. Extract parameter names, parameter values, parameter types, or triggering conditions mentioned in the vulnerability description as triggering parameters through dependency parsing and named entity recognition techniques;

[0055] In this embodiment, dependency parsing tools such as Stanford Parser and spaCy are used to parse the grammatical structure of the vulnerability description, identify parameter-related words and phrases (such as "parameter X must be less than 10"), and combine named entity recognition to extract specific parameter names (such as "X"), parameter values ​​(such as "10"), parameter types (such as "integer") or triggering conditions (such as "when input is null") as triggering parameters.

[0056] 207. Integrate the vulnerability package name, sensitive API, trigger parameters, and vulnerability description into a four-tuple information according to a preset structured format, and store the four-tuple information in a structured database;

[0057] In this embodiment, the four extracted fields are mapped to a four-tuple structure (vulnerable package name, sensitive API, trigger parameter, vulnerability description), serialized into JSON format, and batch inserted into a relational database using a database operation library, and an index is created to optimize query efficiency.

[0058] In this embodiment of the invention, by combining web crawling technology with natural language processing technology, the vulnerability package name and vulnerability description are automatically and accurately extracted from massive CVE announcements. Furthermore, by utilizing BERT-based models and syntactic analysis technology, key sensitive APIs and trigger parameters are extracted from the description text, and finally integrated into high-quality, structured four-tuple information. This provides a reliable and standardized data source for subsequent vulnerability detection and analysis, laying the foundation for the accuracy of the entire method.

[0059] Please see Figure 3 In the third embodiment of the supply chain cross-package vulnerability detection method of the present invention, steps 103 and 104 include:

[0060] 301. Iterate through all dependency package names in the dependency declaration file and perform string matching between the dependency package names and the vulnerability package names in the four-tuple information;

[0061] In this embodiment, the dependency declaration file is read, the dependency package name and version number are parsed line by line, and the string is matched with the vulnerability package name in the four-tuple (supporting exact matching and fuzzy matching, fuzzy matching can ignore case and version suffix), and the matching results are recorded.

[0062] 302. When a match is successful, the source code file is converted into an abstract syntax tree;

[0063] In this embodiment, when a vulnerable package is detected to exist in a dependency declaration, a language-specific parser (such as Python's ast module) is used to parse all source code files into an abstract syntax tree (AST), preserving code structure information (such as function definitions, class definitions, import statements, control flow structures, etc.).

[0064] 303. Identify function definition nodes, class definition nodes, and function call nodes in the abstract syntax tree;

[0065] In this embodiment, the AST is traversed, and a node type recognition algorithm is used to accurately locate all function definition nodes (FunctionDef), class definition nodes (ClassDef), and function call nodes (Call), and node attributes (such as function name, parameter list, return value type, decorator information, etc.) and position information (such as row number, column number) are extracted.

[0066] 304. Based on function definition nodes, class definition nodes, and function call nodes, a cross-package function call graph is constructed using data flow analysis as the result of cross-package call chain analysis;

[0067] In this embodiment, data flow analysis technology is applied to track the call relationships and data dependencies between functions, construct a cross-package function call graph, and accurately reflect the function call paths between different packages and modules, including various call forms such as direct calls, indirect calls, and callback functions. At the same time, the context information of function calls is analyzed, including parameter passing, return value usage, and exception handling, providing comprehensive call chain analysis results.

[0068] 305. Based on the depth-first search algorithm, find all reachable paths from the project entry point to the sensitive API in the cross-package call chain analysis results to obtain the function call sequence of the sensitive API;

[0069] In this embodiment, a depth-first search algorithm is used to find all reachable paths from the project entry point (such as the main function, initialization function, etc.) to the target sensitive API in the constructed function call graph, and the function call sequence on each reachable path is recorded. The function call sequence includes information such as call order, parameter passing and conditional branches.

[0070] 306. Input the quadruple information as prompt words into the preset large language model so that the large language model generates vulnerability verification code;

[0071] In this embodiment, the quadruple information is formatted into a natural language prompt (e.g., "generate code to verify parameter C of API B in vulnerability package A"), input into a large language model (such as OpenAI Codex or a locally deployed LLM), and the generated vulnerability verification code (such as a Python script or unit test) is obtained.

[0072] 307. Use a large language model to verify the reachability of vulnerability verification code in a function call sequence, and output the reachability verification results;

[0073] In this embodiment, the generated vulnerability verification code is combined with the function call sequence to verify whether the code can successfully trigger the target vulnerability along the call sequence in a simulated execution environment. Specifically, static analysis (such as symbolic execution) and dynamic execution (such as sandbox running) are used to verify whether the code is reachable in the call sequence. The reachability verification result is output, which includes quantitative data such as verification status (success / failure), execution path, triggering conditions, and performance indicators.

[0074] In this embodiment of the invention, by transforming the source code into an abstract syntax tree and performing data flow analysis, a function call graph that reflects cross-package call relationships is constructed, thereby achieving a deep insight into the project's code structure. Based on this, a depth-first search algorithm is used to locate all reachable paths of sensitive APIs and obtain their function call sequences. Furthermore, a large language model is innovatively introduced, and targeted vulnerability verification code is generated based on quadruplet information to perform reachability verification. This elevates traditional dependency matching to the code behavior level of verification, significantly enhancing the reliability of vulnerability confirmation.

[0075] Please see Figure 4 In the fourth embodiment of the supply chain cross-package vulnerability detection method of the present invention, steps 105 and 105 thereafter include:

[0076] 401. When the reachability verification result is that the vulnerability is reachable, then the energy consumption of the large language model is statistically analyzed.

[0077] In this embodiment, when the output vulnerability of the large language model is accessible, the system monitors the energy consumption indicators of the model inference process, including GPU / CPU utilization, memory usage, inference time (milliseconds) and power consumption (watt-hours), collects data using performance analysis tools (such as NVIDIA Nsight or Python's psutil library), and calculates the total energy consumption value (such as joules or equivalent carbon emissions).

[0078] 402. Determine whether the energy consumption exceeds the preset energy consumption threshold;

[0079] In this embodiment, the statistical energy consumption value is compared with the preset energy consumption threshold. The energy consumption threshold can be set based on historical benchmark tests or model configuration. For example, if the inference time is less than 2 seconds or the energy consumption is less than 50 joules, it is considered to be low energy consumption and high reliability. The energy consumption threshold can be dynamically adjusted to adapt to different models and hardware environments.

[0080] 403. If not, then set the vulnerability confidence level to high confidence and generate a vulnerability alert message;

[0081] In this embodiment, if the energy consumption is less than or equal to the energy consumption threshold, the system marks the vulnerability confidence as high confidence (e.g., confidence > 90%), which indicates that the vulnerability verification code generated by the large language model is efficient and reliable. The system generates vulnerability alarm information accordingly. Conversely, if the energy consumption is greater than the energy consumption threshold, it is marked as low confidence. At this time, although the reachability verification is passed, the system will not generate an alarm because the reliability of the generated code is questionable.

[0082] 404. Send vulnerability alert information to the management terminal;

[0083] In this embodiment, information is sent to the management terminal (such as the security operations center or developer tools) through multiple channels (such as email, Slack messages, SMS, or webhooks) to ensure that the security team can respond and handle the situation quickly.

[0084] 405. Generate a vulnerability detection report. The vulnerability detection report includes four-tuple information, function call sequence, reachability verification results, vulnerability confidence, and remediation recommendations. The remediation recommendations are determined based on the vulnerability description and historical remediation strategies.

[0085] In this embodiment, complete vulnerability detection data is compiled to generate a structured vulnerability detection report, presented in PDF or HTML format. The vulnerability detection report includes the vulnerability's four-tuple information, detailed function call sequence (visual chart), reachability verification process (text description), confidence score (percentage), and best practice-based remediation recommendations (such as upgrading package version or modifying code logic). The remediation recommendations are determined based on historical remediation strategies that have a mapping relationship with the current vulnerability description, which facilitates the security team's understanding and decision-making.

[0086] 406. Encrypt the vulnerability detection report to obtain an encrypted vulnerability detection report;

[0087] In this embodiment, the vulnerability detection report is encrypted using an encryption algorithm (such as AES-256), and the key is processed through a security key management service (such as AWS KMS) to ensure the security of the report during transmission and storage.

[0088] 407. Upload the encrypted vulnerability detection report to the blockchain;

[0089] In this embodiment, the hash value of the encrypted report or the entire report is uploaded to a blockchain network (such as Ethereum or Hyperledger), and immutable evidence is stored through a smart contract, with an audit interface provided for subsequent verification.

[0090] Furthermore, after a CVE vulnerability is released, the version with the vulnerability confirmed by the detection method of this invention is used as a positive sample through source code differential comparison. After a new version is released, the version with the vulnerability confirmed by the detection method of this invention is used as a negative sample. The positive and negative samples of the old and new versions are used as training samples for training the vulnerability detection model, achieving zero-cost acquisition of high-quality training data. The vulnerability detection model obtained is a lightweight machine learning model. The vulnerability detection model is used for preliminary risk screening. Specifically, after obtaining the function call sequence of sensitive APIs, the relevant code features are input into the vulnerability detection model for preliminary analysis. If the vulnerability detection model outputs low risk, the subsequent detection process of the current vulnerability item is terminated. If the output is high risk, the large language model is triggered to generate vulnerability verification code.

[0091] In addition, an incremental scanning mechanism is established, which uses the source code differential comparison method as a basis to re-examine the source code of the new version of the Python package that originally issued the alert only using the vulnerability function with the patched vulnerability and its related parameters, to confirm whether the new version has patched the vulnerability, thus avoiding a full scan of all Python packages, significantly improving detection efficiency and reducing resource consumption.

[0092] In this embodiment of the invention, by introducing the energy consumption of a large language model as an indirect measure of its output reliability, a dual judgment rule combining "reachability verification" and "energy consumption confidence" is constructed. A high-confidence alarm is only generated when the vulnerability verification code is reachable and the model energy consumption is low (indicating that the generation process is certain and reliable). This effectively filters out false alarms caused by LLM illusion or uncertainty. Subsequently, the system automatically generates a detection report containing complete context and remediation suggestions, and ensures audit traceability through encryption and blockchain evidence storage. This forms a complete closed-loop process from "accurate detection" to "trustworthy alarms" to "secure archiving". While reducing the false alarm rate, it greatly improves the efficiency of vulnerability response and handling and the credibility of the entire detection process.

[0093] The supply chain cross-package vulnerability detection method in the embodiments of the present invention has been described above. The supply chain cross-package vulnerability detection device in the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 5 One embodiment of the supply chain cross-package vulnerability detection device in this invention includes:

[0094] The acquisition module 501 is used to acquire the source code files and dependency declaration files of the target project, and to obtain the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link;

[0095] The extraction and integration module 502 is used to extract sensitive APIs and corresponding trigger parameters from the vulnerability description, and integrate the vulnerability package name, sensitive APIs, trigger parameters and vulnerability description into a four-tuple of information.

[0096] The judgment and analysis module 503 is used to determine whether the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file. If so, the cross-packet chain reachability analysis algorithm is used to perform cross-packet call chain analysis on the source code file to obtain the cross-packet call chain analysis result.

[0097] The generation verification module 504 is used to obtain the function call sequence of sensitive APIs based on the cross-package call chain analysis results, generate vulnerability verification code based on the four-tuple information using the preset large language model, and verify the reachability of the vulnerability verification code in the function call sequence to obtain the reachability verification result.

[0098] The generation module 505 is used to determine the vulnerability confidence based on the energy consumption of the large language model. When the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high, a vulnerability alarm message is generated.

[0099] In this embodiment, the vulnerability package name, sensitive API, trigger parameters, and vulnerability description are integrated into a four-tuple of information. When the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file, the cross-package chain reachability analysis algorithm is used to perform cross-package call chain analysis on the source code file. Based on the cross-package call chain analysis results, the function call sequence of the sensitive API is obtained, thereby realizing vulnerability detection of the cross-package call chain. A vulnerability verification code is generated based on the four-tuple information using a preset large language model, and the reachability of the vulnerability verification code is verified in the function call sequence. The vulnerability confidence is determined based on the energy consumption of the large language model. When the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high, a vulnerability alarm message is generated, thereby realizing dual judgment of the vulnerability, reducing the false alarm rate of the vulnerability and improving user satisfaction.

[0100] Please see Figure 6 Another embodiment of the supply chain cross-package vulnerability detection device in this invention includes:

[0101] The acquisition module 501 is used to acquire the source code files and dependency declaration files of the target project, and to obtain the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link;

[0102] The extraction and integration module 502 is used to extract sensitive APIs and corresponding trigger parameters from the vulnerability description, and integrate the vulnerability package name, sensitive APIs, trigger parameters and vulnerability description into a four-tuple of information.

[0103] The judgment and analysis module 503 is used to determine whether the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file. If so, the cross-packet chain reachability analysis algorithm is used to perform cross-packet call chain analysis on the source code file to obtain the cross-packet call chain analysis result.

[0104] The generation verification module 504 is used to obtain the function call sequence of sensitive APIs based on the cross-package call chain analysis results, generate vulnerability verification code based on the four-tuple information using the preset large language model, and verify the reachability of the vulnerability verification code in the function call sequence to obtain the reachability verification result.

[0105] The generation module 505 is used to determine the vulnerability confidence based on the energy consumption of the large language model. When the reachability verification result is that the vulnerability is reachable and the vulnerability confidence is high, a vulnerability alarm message is generated.

[0106] In this embodiment, the acquisition module 501 includes: a first acquisition unit 5011, used to acquire the source code file and dependency declaration file of the target project; a second acquisition unit 5012, used to acquire CVE announcement text or links from the official CVE website or third-party vulnerability database using web crawling technology; a parsing and extraction unit 5013, used to parse the CVE announcement text or links using natural language processing technology, and extract the vulnerability package name and the vulnerability description corresponding to the vulnerability package name; and a removal unit 5014, used to remove HTML tags, special characters and redundant information from the vulnerability description, whereby redundant information includes duplicate content, advertising information and copyright notices.

[0107] In this embodiment, the extraction and integration module 502 includes: a first identification unit 5021, used to identify function names, method names, class names, or attribute names in the vulnerability description text as sensitive APIs using a BERT-based natural language processing model; an extraction unit 5022, used to extract parameter names, parameter values, parameter types, or triggering conditions mentioned in the vulnerability description as triggering parameters through dependency parsing and named entity recognition technology; and an integration unit 5023, used to integrate the vulnerability package name, sensitive APIs, triggering parameters, and vulnerability description into a four-tuple information according to a preset structured format, and store the four-tuple information in a structured database.

[0108] In this embodiment, the judgment and analysis module 503 includes: a traversal matching unit 5031, used to traverse all dependency package names in the dependency declaration file and perform string matching between the dependency package names and the vulnerability package names in the four-tuple information; a conversion unit 5032, used to convert the source code file into an abstract syntax tree when the matching is successful; a second identification unit 5033, used to identify function definition nodes, class definition nodes and function call nodes in the abstract syntax tree; and a construction unit 5034, used to construct a cross-package function call graph based on the function definition nodes, class definition nodes and function call nodes using data flow analysis as the cross-package call chain analysis result.

[0109] In this embodiment, the generation verification module 504 includes: a search unit 5041, used to search for all reachable paths from the project entry point to the sensitive API in the cross-package call chain analysis results based on a depth-first search algorithm, and obtain the function call sequence of the sensitive API; an input unit 5042, used to input the quadruple information as prompt words into a preset large language model, so that the large language model generates vulnerability verification code; and a verification output unit 5043, used to use the large language model to verify the reachability of the vulnerability verification code in the function call sequence, and output the reachability verification result.

[0110] In this embodiment, the determination generation module 505 includes: a statistics unit 5051, used to count the energy consumption of the large language model when the reachability verification result is that the vulnerability is reachable; a judgment unit 5052, used to judge whether the energy consumption is greater than a preset energy consumption threshold; and a determination generation unit 5053, used to determine the vulnerability confidence as high confidence and generate vulnerability alarm information if not.

[0111] In this embodiment, the system further includes: a sending module 506, used to send the vulnerability alert information to a management terminal; a generation module 507, used to generate a vulnerability detection report, the vulnerability detection report including four-tuple information, function call sequence, reachability verification results, vulnerability confidence, and remediation suggestions, the remediation suggestions being determined based on vulnerability description and historical remediation strategies; an encryption module 508, used to encrypt the vulnerability detection report to obtain an encrypted vulnerability detection report; and an uploading module 509, used to upload the encrypted vulnerability detection report to the blockchain.

[0112] above Figure 5 and Figure 6 The supply chain cross-package vulnerability detection device in this embodiment of the invention is described in detail from the perspective of modular functional entities. The supply chain cross-package vulnerability detection device in this embodiment of the invention is described in detail below from the perspective of hardware processing.

[0113] Figure 7This is a schematic diagram of the structure of a supply chain cross-package vulnerability detection device 600 provided in an embodiment of the present invention. The supply chain cross-package vulnerability detection device 600 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 610 (e.g., one or more processors) and a memory 620, and one or more storage media 630 (e.g., one or more mass storage devices) for storing application programs 633 or data 632. The memory 620 and storage media 630 can be temporary or persistent storage. The program stored in the storage media 630 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the supply chain cross-package vulnerability detection device 600. Furthermore, the processor 610 may be configured to communicate with the storage media 630 and execute a series of instruction operations on the storage media 630 on the supply chain cross-package vulnerability detection device 600 to implement the steps of the supply chain cross-package vulnerability detection method provided in the above-described method embodiments.

[0114] The supply chain cross-package vulnerability detection device 600 may also include one or more power supplies 640, one or more wired or wireless network interfaces 650, one or more input / output interfaces 660, and / or one or more operating systems 631, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 7 The illustrated supply chain cross-package vulnerability detection device structure does not constitute a limitation on supply chain cross-package vulnerability detection devices, and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0115] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of the supply chain cross-package vulnerability detection method.

[0116] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0117] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0118] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting cross-package vulnerabilities in a supply chain, characterized in that, include: Obtain the source code files and dependency declaration files of the target project, and obtain the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link; Extract the sensitive API and the triggering parameters corresponding to the sensitive API from the vulnerability description, and integrate the vulnerability package name, the sensitive API, the triggering parameters and the vulnerability description into a four-tuple of information; Determine whether the vulnerability package corresponding to the quadruple information exists in the dependency declaration file. If so, use the cross-packet chain reachability analysis algorithm to perform cross-packet call chain analysis on the source code file to obtain the cross-packet call chain analysis result. Based on the cross-package call chain analysis results, the function call sequence of the sensitive API is obtained. Vulnerability verification code is generated based on the quadruple information using a preset large language model. The reachability of the vulnerability verification code is verified in the function call sequence to obtain the reachability verification result. The vulnerability confidence level is determined based on the energy consumption of the large language model. When the reachability verification result indicates that the vulnerability is reachable and the vulnerability confidence level is high, a vulnerability alert is generated. The step involves determining whether the vulnerability package corresponding to the four-tuple information exists in the dependency declaration file. If so, a cross-package call chain analysis algorithm is used to perform cross-package call chain analysis on the source code file to obtain the cross-package call chain analysis results, including: Iterate through all dependency package names in the dependency declaration file and perform string matching between the dependency package name and the vulnerability package name in the four-tuple information; When a match is successful, the source code file is converted into an abstract syntax tree; Identify function definition nodes, class definition nodes, and function call nodes in the abstract syntax tree; Based on the function definition node, the class definition node, and the function call node, a cross-package function call graph is constructed using data flow analysis as the result of the cross-package call chain analysis.

2. The supply chain cross-package vulnerability detection method according to claim 1, characterized in that, The steps of obtaining the source code files and dependency declaration files of the target project, and obtaining the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link, include: Obtain the source code files and dependency declaration files of the target project; Use web scraping techniques to obtain CVE announcement text or links from the official CVE website or third-party vulnerability databases; The CVE announcement text or link is parsed using natural language processing technology, and the vulnerability package name and the vulnerability description corresponding to the vulnerability package name are extracted. Remove HTML tags, special characters, and redundant information from the vulnerability description. The redundant information includes duplicate content, advertising information, and copyright notices.

3. The supply chain cross-package vulnerability detection method according to claim 1, characterized in that, The step of extracting sensitive APIs and corresponding triggering parameters from the vulnerability description, and integrating the vulnerability package name, the sensitive APIs, the triggering parameters, and the vulnerability description into a four-tuple of information, includes: The BERT-based natural language processing model is used to identify function names, method names, class names, or attribute names in the vulnerability description text as sensitive APIs. The parameter names, parameter values, parameter types, or triggering conditions mentioned in the vulnerability description are extracted as triggering parameters through dependency parsing and named entity recognition techniques. The vulnerability package name, the sensitive API, the triggering parameters, and the vulnerability description are integrated into a four-tuple information according to a preset structured format, and the four-tuple information is stored in a structured database.

4. The supply chain cross-package vulnerability detection method according to claim 1, characterized in that, The process involves obtaining the function call sequence of the sensitive API based on the cross-package call chain analysis results, generating vulnerability verification code based on the four-tuple information using a preset large language model, and verifying the reachability of the vulnerability verification code within the function call sequence to obtain reachability verification results, including: Based on the depth-first search algorithm, all reachable paths from the project entry point to the sensitive API are found in the cross-package call chain analysis results, and the function call sequence of the sensitive API is obtained. The quadruple information is input as a prompt word into a preset large language model so that the large language model generates vulnerability verification code; The reachability of the vulnerability verification code is verified in the function call sequence using the large language model, and the reachability verification result is output.

5. The supply chain cross-package vulnerability detection method according to claim 1, characterized in that, The vulnerability confidence level is determined based on the energy consumption of the large language model. When the reachability verification result indicates that the vulnerability is reachable and the vulnerability confidence level is high, a vulnerability alert is generated, including: When the reachability verification result is that the vulnerability is reachable, the energy consumption of the large language model is statistically analyzed. Determine whether the energy consumption exceeds a preset energy consumption threshold; If not, the vulnerability confidence level is set to high confidence, and a vulnerability alert is generated.

6. The supply chain cross-package vulnerability detection method according to claim 1, characterized in that, After determining the vulnerability confidence level based on the energy consumption of the large language model, and generating a vulnerability alert when the reachability verification result indicates the vulnerability is reachable and the vulnerability confidence level is high, the method further includes: Send the vulnerability alert information to the management terminal; Generate a vulnerability detection report, which includes four-tuple information, function call sequence, reachability verification results, vulnerability confidence, and remediation suggestions. The remediation suggestions are determined based on the vulnerability description and historical remediation strategies. The vulnerability detection report is encrypted to obtain an encrypted vulnerability detection report; The encrypted vulnerability detection report is uploaded to the blockchain.

7. An apparatus based on the supply chain cross-package vulnerability detection method according to claim 1, characterized in that, include: The acquisition module is used to acquire the source code files and dependency declaration files of the target project, and to obtain the vulnerability package name and the vulnerability description corresponding to the vulnerability package name from the CVE announcement text or link; An extraction and integration module is used to extract sensitive APIs and corresponding trigger parameters from the vulnerability description, and integrate the vulnerability package name, the sensitive APIs, the trigger parameters and the vulnerability description into a four-tuple of information; The judgment and analysis module is used to determine whether the vulnerability package corresponding to the quadruple information exists in the dependency declaration file. If so, the cross-package call chain analysis algorithm is used to perform cross-package call chain analysis on the source code file to obtain the cross-package call chain analysis result. The generation and verification module is used to obtain the function call sequence of the sensitive API based on the cross-package call chain analysis results, generate vulnerability verification code based on the quadruple information using a preset large language model, and verify the reachability of the vulnerability verification code in the function call sequence to obtain the reachability verification result. The generation module is used to determine the vulnerability confidence level based on the energy consumption of the large language model. When the reachability verification result is that the vulnerability is reachable and the vulnerability confidence level is high, a vulnerability alarm message is generated.

8. A supply chain cross-package vulnerability detection device, characterized in that, The supply chain cross-package vulnerability detection device includes: a memory and at least one processor, wherein the memory stores instructions; At least one of the processors invokes the instructions in the memory to cause the supply chain cross-package vulnerability detection device to perform the steps of the supply chain cross-package vulnerability detection method as described in any one of claims 1-6.

9. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the various steps of the supply chain cross-package vulnerability detection method as described in any one of claims 1-6.

Images