Component risk prediction method, system, and storage medium based on time-series prediction

Abstract

This application relates to the field of computer technology, and in particular to a component risk prediction method, system, and storage medium based on time-series prediction. The method includes collecting multi-dimensional feature data of open-source components, deconstructing the data on a time scale based on the frequency of change of each feature's index, and constructing a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences. It calculates a trend inertia index reflecting long-term decline trends and an instantaneous pulse index reflecting short-term abnormal fluctuations, generating a time-series prediction input vector. This input vector is then input into a long short-term memory network model, outputting the component's basic risk probability within a preset future time window. A component risk score is calculated and generated based on the basic risk probability, trend inertia index, and instantaneous pulse index. Finally, the component risk score is compared with a preset safety threshold, and tiered warnings or automatic interception operations are performed. This application can output accurate and interpretable risk warning results.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a component risk prediction method, system and storage medium based on time-series prediction. Background Technology

[0002] With the rapid development of the software industry, open-source software has become the infrastructure of modern software development. While improving development efficiency, the security risks introduced by open-source components are also becoming increasingly serious. From traditional vulnerability exploitation to frequent software supply chain security incidents, component security issues are characterized by strong concealment, rapid outbreak, and wide-ranging impact. To ensure the security of the software supply chain, risk assessment and early warning technologies for open-source components have become a research hotspot.

[0003] In existing technologies, early component risk management primarily relied on static software component analysis, which involved scanning component version numbers to match publicly available vulnerability databases. However, this method suffers from significant lag, only providing passive defense after vulnerabilities are disclosed, and failing to address potential risks from unknown zero-day vulnerabilities or deteriorating component maintenance status. To compensate for the shortcomings of static analysis, in recent years, some researchers have begun to introduce dynamic indicators and combine them with machine learning models such as Long Short-Term Memory (LSTM) networks to predict component risks over time. The typical approach involves collecting multidimensional statistical data on the component over a period of time, covering aspects such as community activity (e.g., code submission frequency, percentage of new contributors) and security history (e.g., issue resolution rate, historical vulnerability density), normalizing this data, and directly concatenating it into a feature vector sequence. This sequence is then input into a model for training to predict the future risk probability of the component.

[0004] However, the above-mentioned risk prediction method has limitations in practical applications. Because different dimensions of open-source components objectively exhibit different time-evolution characteristics—for example, community activity indicators often show long-term, gradual changes, while security history indicators tend to show short-term, sudden fluctuations—existing technologies that directly concatenate these multi-dimensional data with different frequency characteristics and perform homogenized time-series modeling can easily lead to mutual interference between features. This makes it difficult for the model to accurately capture the decline trend of long-term indicators or the abnormal mutation of short-term indicators. Consequently, the risk prediction results output by the model often deviate from the actual security status of the component, failing to meet the accurate early warning requirements in high-security scenarios. Summary of the Invention

[0005] This application provides a component risk prediction method, system, and storage medium based on time-series prediction, which can output accurate and interpretable risk warning results, meeting the accurate warning requirements in high-security scenarios. This application provides the following technical solutions:

[0006] In a first aspect, this application provides a component risk prediction method based on time series forecasting, the method comprising:

[0007] Collect multidimensional feature data from open-source components and deconstruct them over time based on the frequency of change of each feature's indicators to construct a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences;

[0008] Based on the slow evolution sequence and fast mutation sequence in the heterogeneous feature sequence set, the trend inertia index reflecting the long-term decline trend and the instantaneous pulse index reflecting the short-term abnormal fluctuation are calculated respectively to generate a time series prediction input vector.

[0009] The time-series prediction input vector is input into a pre-trained long short-term memory network model to perform time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within a future preset time window.

[0010] The final component risk score is calculated and generated based on the basic risk probability, the trend inertia index, and the instantaneous pulse index.

[0011] The component risk score is compared with a preset security threshold, and open-source components with a risk score higher than the preset security threshold are subject to tiered warnings or automatic blocking.

[0012] In one specific implementation, the time-scale deconstruction based on the frequency of change of each feature's index includes:

[0013] The frequency of change of the index refers to the degree of fluctuation of a certain feature value within a preset sliding time window, which is obtained by calculating the ratio of the standard deviation of a certain feature sequence to its mean within the window.

[0014] A frequency threshold is pre-set as the dividing boundary, and the frequency of change of each characteristic index is compared with the frequency threshold one by one.

[0015] If the calculated value of the frequency of change of an indicator is lower than the frequency threshold, it indicates that the fluctuation is small and the trend is stable, and it is identified as a high inertia indicator.

[0016] If the calculated value of the frequency of change of an indicator is higher than the threshold, it indicates that the indicator fluctuates violently and is sensitive to sudden events, and it is identified as a high volatility indicator.

[0017] In one specific implementation, constructing a heterogeneous feature sequence set comprising slow-evolving sequences and fast-mutating sequences includes:

[0018] For data identified as having high inertia, smoothing and denoising are performed to filter out high-frequency random noise in order to retain the long-term trend terms, and the data are arranged in chronological order to generate a slow evolution sequence.

[0019] For data identified as high volatility indicators, the original volatility amplitude and extreme points of the data are retained, without excessive smoothing, and arranged in chronological order to generate a rapid mutation sequence.

[0020] The slow evolution sequence and the fast mutation sequence are aligned in the time dimension, together forming a heterogeneous feature sequence set.

[0021] In one specific implementation scheme, the step of calculating the trend inertia index reflecting long-term decline trends and the instantaneous impulse index reflecting short-term abnormal fluctuations based on the slow evolution sequences and fast mutation sequences in the heterogeneous feature sequence set, respectively, to generate a time series prediction input vector includes:

[0022] The trend inertia index is a physical indicator that quantifies the stability and irreversibility of a slow-evolutionary sequence declining in a specific direction at the current moment. The formula for calculating the trend inertia index is as follows:

[0023] ;

[0024] In the formula, express The trend inertia index at any given moment. This indicates that for the slow-evolving sequence up to the current time... The slope of the straight line obtained by performing linear regression fitting on the data within the preset sliding window. and Let represent the mean and standard deviation of all data in the slow evolution sequence within the sliding window, respectively. To prevent tiny constants with a denominator of zero;

[0025] The instantaneous pulse index is a physical indicator that quantifies the burst energy and acceleration deviation of a fast mutation sequence caused by a sudden event at the current moment; the formula for calculating the instantaneous pulse index is as follows:

[0026] ;

[0027] In the formula, express The instantaneous pulse index at time t, Indicating rapid mutation sequences in The value of the moment. Indicating rapid mutation sequences in The first difference value at time t; Indicating rapid mutation sequences in The second difference value at time; and These represent the global mean and global standard deviation of the fast mutation sequence over its entire historical lifespan, respectively. This is the acceleration weighting coefficient.

[0028] In one specific implementation scheme, the step of calculating the trend inertia index reflecting long-term decline trends and the instantaneous impulse index reflecting short-term abnormal fluctuations based on the slow evolution sequences and fast mutation sequences in the heterogeneous feature sequence set, respectively, to generate a time series prediction input vector includes:

[0029] For each time step in the time series, the normalized original multidimensional feature data of the current moment is extracted as the basic feature vector. The calculated trend inertia index and instantaneous pulse index are added to the end of the basic feature vector in a fixed index order to form an expanded joint feature vector. The joint feature vector is used as the input vector for the generated time series prediction.

[0030] In one specific implementation, the step of inputting the time-series prediction input vector into a pre-trained long short-term memory network model for time-series dependency analysis captures the long-term dependencies between indicators, and outputs the basic risk probability of the component within a future preset time window, including:

[0031] An initial deep neural network architecture including a long short-term memory network layer, a fully connected layer, and an output layer is established, and a training sample set is constructed based on the historical full set of open source component behavior data;

[0032] The input to the training samples is the sequence of time-series prediction input vectors generated by the component within the historical observation window; the output label is whether a security vulnerability disclosure or maintenance blocking event actually occurred in the component within a subsequent time window.

[0033] During training, the sample set is input into the initial network, the binary cross-entropy loss between the network output value and the true label is calculated, and the gradient is calculated using the backpropagation algorithm over time. The weight matrix and bias terms of the network are iteratively updated through the Adam optimizer. When the loss function of the model on the validation set converges to the preset threshold, the iteration is stopped and the model parameters are locked to obtain the long short-term memory network model.

[0034] The time-series prediction input vector is input into the Long Short-Term Memory (LSTM) network model for time-series dependency analysis. The LTM network model processes the hidden state after passing through the time step using the Sigmoid activation function of the output layer and performs normalization mapping to output the basic risk probability of the component within a future preset time window.

[0035] In one specific implementation scheme, the calculation and generation of the final component risk score based on the basic risk probability, trend inertia index, and instantaneous pulse index includes:

[0036] The component risk score is calculated using the following formula:

[0037] ;

[0038] in, This represents the calculated component risk score. This represents the theoretical upper limit of the scoring system. Indicates the basic risk probability. Indicates the damping coefficient. and These are the trend inertia index and the instantaneous pulse index, respectively.

[0039] Secondly, this application provides a component risk prediction system based on time series prediction, which adopts the following technical solution:

[0040] A component risk prediction system based on time series forecasting includes:

[0041] The feature extraction module is used to collect multidimensional feature data from open-source components and deconstruct the data over time based on the frequency of change of each feature's indicators, thereby constructing a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences.

[0042] The vector generation module is used to calculate the trend inertia index, which reflects the long-term decline trend, and the instantaneous pulse index, which reflects the short-term abnormal fluctuations, based on the slow evolution sequence and the fast mutation sequence in the heterogeneous feature sequence set, respectively, so as to generate a time series prediction input vector.

[0043] The model prediction module is used to input the time-series prediction input vector into a pre-trained long short-term memory network model for time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within a future preset time window.

[0044] The scoring calculation module is used to calculate and generate the final component risk score based on the basic risk probability, the trend inertia index, and the instantaneous pulse index.

[0045] The security warning module is used to compare the component risk score with a preset security threshold, and to perform graded warnings or automatic blocking operations on open source components whose component risk scores are higher than the preset security threshold.

[0046] Thirdly, this application provides an electronic device, the device including a processor and a memory; the memory stores a program, the program being loaded and executed by the processor to implement a component risk prediction method based on time-series prediction as described in the first aspect.

[0047] Fourthly, this application provides a computer-readable storage medium storing a program that, when executed by a processor, is used to implement a component risk prediction method based on time-series prediction as described in the first aspect.

[0048] First, based on the frequency of indicator changes, the multidimensional features of open-source components are deconstructed into two heterogeneous sequences: slow evolution and rapid mutation. Then, the trend inertia index, representing long-term decline, and the instantaneous pulse index, representing short-term fluctuations, are calculated specifically. These two physical indices are then combined with the basic risk probability output by the Long Short-Term Memory network to generate the final score and implement control measures. This pre-construction of the time scale physically isolates the previously mixed long-cycle and short-cycle signals, effectively eliminating the mutual interference caused by directly splicing features of different frequencies. Furthermore, by calculating the trend inertia index and the instantaneous pulse index separately, the declining trend in the slow indicators and the sudden anomalies in the fast indicators are explicitly extracted. This divide-and-conquer followed by deep fusion strategy ensures that the model neither obscures long-term hidden dangers due to high-frequency noise nor loses sudden signals due to over-smoothing, thus solving the risk prediction bias problem caused by homogeneous modeling in existing technologies.

[0049] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, the preferred embodiments of this application are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0050] Figure 1 This is a flowchart illustrating the component risk prediction method based on time-series prediction in the embodiments of this application.

[0051] Figure 2 This is a schematic diagram of the overall process of the component risk prediction method based on time-series prediction in the embodiments of this application.

[0052] Figure 3 This is a structural block diagram of the component risk prediction system based on time-series prediction in the embodiments of this application.

[0053] Figure 4 This is a block diagram of an electronic device based on time-series prediction for component risk prediction in an embodiment of this application. Detailed Implementation

[0054] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0055] Optionally, this application uses the component risk prediction method based on time-series prediction provided in various embodiments as an example for illustration in electronic devices. The electronic device is a terminal or a server. The terminal can be a computer, tablet computer, etc. This embodiment does not limit the type of electronic device.

[0056] Reference Figure 1 This is a flowchart illustrating a component risk prediction method based on time-series prediction provided in one embodiment of this application. The method includes at least the following steps:

[0057] Step S101: Collect multidimensional feature data of open source components, and deconstruct them on a time scale based on the frequency of change of each feature's index to construct a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences.

[0058] In step S101, by establishing a multi-source data acquisition channel for the open-source component, the original behavioral data of the target open-source component within a historical time window is obtained. Statistical methods are then used to quantitatively analyze the frequency domain characteristics of this original behavioral data, thereby achieving time-scale deconstruction of the data. The core of this process lies in separating the originally mixed risk signals according to their physical evolution speed attributes, generating two sets of feature sequences that are distinctly different in terms of time granularity and fluctuation characteristics, ensuring that each type of feature can be expressed at its most suitable time scale.

[0059] Specifically, the first step is to establish a multi-source heterogeneous data collection channel to obtain multi-dimensional feature data of open-source components. This involves connecting to code hosting platforms, package manager repositories, or public vulnerability databases via standard API interfaces to incrementally crawl and obtain historical behavior records of the target open-source components. The collected multi-dimensional feature data covers key indicators reflecting different aspects of the component, including code activity indicators, community stability indicators, project popularity indicators, and security history indicators. Specifically, code activity indicators include the number of code commits and lines of code changes per unit time; community stability indicators include the retention rate of core contributors and the growth rate of new contributors; project popularity indicators include changes in component downloads and the number of references by downstream projects; and security history indicators include the number of disclosed vulnerabilities, vulnerability density, and the average resolution time for issues. Since each indicator category contains multiple sub-dimensions with different dimensions, before subsequent processing, the sub-dimension data within the same category needs to be normalized to eliminate dimensional differences and then fused using a weighted summation method to generate a unique time-series data stream for each key indicator.

[0060] After obtaining the aforementioned basic data, the concept of indicator change frequency is introduced to quantify the fluctuation characteristics of different features over time, and time-scale deconstruction is performed accordingly. This process is essentially a quantitative classification operation based on the intensity of data fluctuations in the time domain. Indicator change frequency refers to the degree of fluctuation of a certain feature value within a preset sliding time window. Specifically, it is obtained by calculating the ratio of the standard deviation of the feature sequence within the window to its mean. This ratio directly reflects the degree of dispersion and the intensity of evolution of the indicator on the time axis. In implementation, a frequency threshold is preset as the dividing boundary, and the calculated indicator change frequency of each feature is compared with this frequency threshold one by one. For features whose calculated indicator change frequency is lower than the threshold, it indicates that their fluctuation is small and the trend is stable, and they are identified as high-inertia indicators. These indicators usually reflect the long-term ecological accumulation and decline trend of components, such as community stability indicators and project popularity indicators. For features whose calculated indicator change frequency is higher than the threshold, it indicates that their fluctuation is drastic and sensitive to sudden events, and they are identified as high-volatility indicators. These indicators usually reflect the current real-time operating status of components and external shocks, such as code activity indicators and security history indicators.

[0061] Based on the above identification results, a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences was further constructed. For data identified as high inertia indicators, smoothing and denoising were performed to filter out high-frequency random noise and retain its long-term trend terms. These were then arranged chronologically to generate a slow evolution sequence, which primarily carries information about the component's lifecycle health. For data identified as high volatility indicators, the original data's volatility amplitude and extreme points were retained without excessive smoothing. These were then arranged chronologically to generate a fast mutation sequence, which primarily carries information about sudden anomalies in the component. The slow evolution sequences and fast mutation sequences maintained strict alignment in the time dimension, together forming the final heterogeneous feature sequence set.

[0062] This step achieves orthogonal decomposition of risk characteristics in the time-frequency domain. This processing method effectively prevents high-frequency short-term fluctuation noise from masking low-frequency long-term decay trends, while also ensuring that signals of sudden security events are not weakened by smoothing, thus solving the information masking problem caused by mismatch in characteristic frequency characteristics in existing technologies.

[0063] Step S102: Based on the slow evolution sequence and fast mutation sequence in the heterogeneous feature sequence set, calculate the trend inertia index reflecting the long-term decline trend and the instantaneous pulse index reflecting the short-term abnormal fluctuation, respectively, to generate the time series prediction input vector.

[0064] In step S102, based on the heterogeneous feature sequence set constructed in step S101, specific nonlinear calculation models are used to extract features from the slow evolution sequences and fast mutation sequences contained therein, taking into account their differences in physical characteristics. By calculating the trend inertia index and the instantaneous impulse index, the simple time series numerical values ​​are transformed into physical features that can characterize the risk evolution state of the components, and these features are concatenated with the original features to generate a time series prediction input vector.

[0065] Specifically, the trend inertia index is first calculated for slow-evolutionary sequences. The trend inertia index is a physical indicator that quantifies the stability and irreversibility of a slow-evolutionary sequence's decline in a specific direction at the current moment. In statistical principles, a stable downward trend with low volatility has stronger inertia than an oscillating downward trend with high volatility, meaning that the ecosystem of this component is undergoing an irreversible structural decline. To capture this characteristic, a formula for calculating the trend inertia index based on regression slope and signal-to-noise ratio enhancement is designed as follows:

[0066] ;

[0067] In this formula, express The trend inertia index at any given moment. This indicates that for the slow-evolving sequence up to the current time... The slope of the straight line obtained by linear regression fitting of the data within the preset sliding window reflects the rate and direction of change of the slow index. and Let represent the mean and standard deviation of all data in the slow evolution sequence within the sliding window, respectively. To prevent the use of tiny constants with a denominator of zero, the formula is based on the introduction of the signal-to-noise ratio (SNR) concept as a quality weight for the trend. The fractional term in the formula essentially quantifies the SNR of the data. When a component is in a stable decline process, the standard deviation of data fluctuations is small, leading to a significant increase in the SNR. This design allows the model to distinguish between two different types of decline: for oscillating declines with the same slope but large fluctuations, the calculated inertia exponent is low due to the larger standard deviation; while for stagnant declines with the same slope but small fluctuations, the formula amplifies the weight of the slope through the logarithmic term due to the high SNR, thus outputting a higher risk inertia value. This calculation method can accurately identify those highly concealed, chronically high-risk components that exhibit a slow, insidious decline characteristic.

[0068] Subsequently, the instantaneous pulse exponent is calculated for fast mutation sequences. The instantaneous pulse exponent is a physical index that quantifies the burst energy and acceleration deviation of a fast mutation sequence at the current moment due to a sudden event. Traditional threshold detection methods often have a lag, making it difficult to capture anomalies in their early stages. To address this issue, a formula for calculating the instantaneous pulse exponent based on second-order difference and exponential penalty is designed as follows:

[0069] ;

[0070] In this formula, express The instantaneous pulse index at time t, Indicating rapid mutation sequences in The value of the moment. Indicating rapid mutation sequences in The first difference value at any given time reflects the instantaneous speed of change in the index; Indicating rapid mutation sequences in The second difference value at time t reflects the acceleration of the index change; and These represent the global mean and global standard deviation of the fast mutation sequence over its entire historical lifespan, respectively. This is the acceleration weighting coefficient. The principle behind this formula is mainly reflected in two aspects: First, the introduction of the second-order difference term is to capture the dynamic characteristics of risk evolution. When the indicator is in an accelerated deterioration stage, even if the current value has not yet reached the high-risk threshold, the second-order difference term will produce a significant gain, thereby achieving early perception of crisis precursors. Second, the use of an exponential function to perform nonlinear mapping of the deviation means that as the degree of deviation of the indicator from the global mean increases, its risk index grows exponentially and nonlinearly. This design conforms to the avalanche effect characteristics of safety risks, ensuring that the model maintains extremely high sensitivity to extreme abnormal events.

[0071] After calculating the two key indices mentioned above, the final time series prediction input vector is constructed. Specifically, for each time step in the time series, the normalized original multidimensional feature data at that moment is first extracted as the basic feature vector. Then, the calculated trend inertia index and instantaneous impulse index are added as two independent additional dimensions to the end of the basic feature vector in a fixed index order, thus forming an expanded joint feature vector. This joint feature vector is the final time series prediction input vector generated in this step. Its significant feature is that it explicitly encodes the dynamic state of risk evolution: the trend inertia index, by introducing the signal-to-noise ratio as a mass weight and combining it with the rate of change, maps slow decay to momentum characteristics in physics, reflecting the irreversibility of risk evolution; the instantaneous impulse index, by introducing a second-order difference term and exponential deviation, maps rapid mutations to acceleration and impact energy characteristics in physics, reflecting the severity of risk outbreak. This augmentation of the physical dimension allows the generated vectors to not only fully preserve the statistical distribution information of the original data, but also to more deeply depict the motion of components in the risk space, directly enhancing the data's ability to fully express complex risk states.

[0072] Step S103: Input the time-series prediction input vector into the pre-trained long short-term memory network model to perform time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within the future preset time window.

[0073] In step S103, deep learning technology is used to perform time-series extrapolation of the risk state of the component. This step first constructs and trains a long short-term memory network model with temporal memory capabilities through supervised learning. Then, the trained model is used to process the time-series prediction input vector generated in step S102 to deeply mine the implicit time span dependencies in the feature sequence, and finally calculate the statistical probability of the component's risk.

[0074] Specifically, the first step is to train a Long Short-Term Memory (LSTM) network model to obtain a pre-trained model. An initial deep neural network architecture is established, comprising LSM layers, fully connected layers, and an output layer. A training sample set is constructed based on historical open-source component behavior data. The input to the training samples is a sequence of time-series predicted input vectors generated by the component within a historical observation window, which already includes the trend inertia exponent and the instantaneous impulse exponent. The output label indicates whether a security vulnerability disclosure or maintenance blocking event actually occurred for the component in a subsequent time window. During training, the sample set is input into the initial network, the binary cross-entropy loss between the network output value and the true label is calculated, and the gradient is calculated using the backpropagation algorithm over time. The weight matrix and bias terms of the network are iteratively updated using the Adam optimizer. When the loss function of the model on the validation set converges to a preset threshold, iteration stops and the model parameters are locked, resulting in a pre-trained LSM network model that accurately reflects the mapping relationship between feature evolution and risk occurrence.

[0075] Subsequently, the temporal prediction input vector generated in step S102 is input into the pre-trained Long Short-Term Memory (LSTM) network model for temporal dependency analysis. During this analysis, the model utilizes its unique gating mechanism and cell state structure to capture long-term dependencies between indicators. The LTM network introduces a cell state chain spanning all time steps as an information conveyor, enabling the lossless transmission of key early state information to the current moment. The model's forget gate automatically filters out short-term random fluctuations that are ineffective for risk prediction based on the current input, while the input gate identifies and retains trend features with significant predictive value and updates them to the cell state. Through this mechanism, the model can effectively connect causal logic with long time spans, such as establishing a strong correlation between a slight decline in community activity starting six months ago and the current security risk, thereby identifying long-term risk evolution patterns that are difficult for traditional linear models to capture.

[0076] Finally, the Long Short-Term Memory (LSTM) network model processes the hidden state passed through time steps and performs normalization mapping through the Sigmoid activation function of the output layer, outputting the basic risk probability of the component within a preset future time window. This basic risk probability is a continuous value between 0 and 1, which intuitively quantifies the likelihood of the component evolving into a high-risk object under the current dynamic state, representing the model's objective statistical inference of the current situation based on historical patterns.

[0077] Step S104: Calculate and generate the final component risk score based on the basic risk probability, trend inertia index and instantaneous pulse index.

[0078] In step S104, the composition logic of the component risk score is first defined. In this embodiment, a complete risk score system includes three dimensions: historical statistical patterns, internal structural vulnerability, and external sudden shocks. The basic risk probability output by the Long Short-Term Memory network represents a statistical benchmark based on historical big data, reflecting the component's risk probability under normal evolutionary paths; the trend inertia index represents the structural vulnerability of the component's internal ecological decline, reflecting the component's robustness against risks; and the instantaneous impulse index represents the intensity of the sudden event impact at the current moment, reflecting the external excitation force that induces a qualitative change in risk. Only by organically combining these three dimensions can the comprehensive risk state of the component under a specific spatiotemporal context be truly restored.

[0079] It should be noted that, because Long Short-Term Memory (LSTM) networks are probabilistic prediction models, their output base risk probabilities are normalized by the Sigmoid activation function, resulting in a numerical saturation effect. This means that when the input physical indicators exceed a certain threshold, the network's output probability tends to flatten, making it difficult to distinguish the magnitude difference between high risk and extreme catastrophic risk. Furthermore, the black-box nature of neural networks easily leads to the dilution of the original magnitude information of physical features during deep transmission. Therefore, in addition to generating the time-series prediction input vector based on the trend inertia index and the instantaneous pulse index, the trend inertia index and the instantaneous pulse index must be explicitly introduced for risk scoring calculation. This approach employs a dual-channel fusion strategy of probability and physics, using the base risk probability as a benchmark channel reflecting historical patterns and the trend inertia index and the instantaneous pulse index as direct channels reflecting current intensity, compensating for the saturation and dilution problems of the neural network through explicit calculation. This calculation is based on the indices at the same time point because... The trend inertia index aggregates historical structural vulnerabilities through a sliding window, while the moment... The instantaneous pulse index captures the real-time external impact force. The combination of the two at the same moment accurately describes the true state of the coherent resonance between the historically accumulated internal factors and the current triggering factors at this instant, thus achieving effective compensation for the saturation problem of neural networks.

[0080] Based on the above logic, the component risk score is calculated using the following formula:

[0081] ;

[0082] in, This represents the calculated component risk score. This represents the theoretical upper limit of the scoring system. This represents the base risk probability output in step S103. This represents the damping coefficient. The design of the above formula follows the principle of residual safety margin dissipation. This represents the remaining safety margin that has not yet been consumed, signifying the system's capacity to withstand risk. When both the trend inertia exponent and the instantaneous impulse exponent increase simultaneously, it indicates that the system is in a state of resonance between structural decay and external shocks. The product term will be significantly amplified, causing the exponential term to decay rapidly. This makes the correction term within the parentheses approach 1, thus quickly exhausting the remaining safety margin and ultimately causing the risk score to approach its upper limit. This mechanism ensures that even when components are in a low-probability but high-damage extreme risk state, the system can still output a score value far higher than that of conventional risks, achieving a non-linear amplification of risk intensity.

[0083] In another feasible embodiment, the component risk score can also be generated using a calculation method based on the LogSumExp (logarithmic exponential sum) smoothed maximum value function, as shown in the following formula:

[0084] ;

[0085] in, Indicates component risk score; This represents the upper limit of the scoring system. It is the risk focus coefficient, and satisfies ; To normalize physical indices to a standardized function in the range of 0 to 1; The normalization constant is used to maintain the numerical scale stability of the scoring results. The above formula adopts a nonlinear calculation formula based on the theory of maximum risk potential dominance. The core logic of this formula design lies in using the mathematical properties of logarithmic exponents and functions to achieve a smooth approximation of the maximum value among multidimensional risk factors. In the actual component risk evolution, there is often a single-point collapse effect, that is, as long as any one of the indicators of basic risk probability, trend inertia index, or instantaneous impulse index breaks through the safety extreme value, regardless of the performance of other indicators, the component should be judged as a high-risk object. Traditional linear weighted formulas are prone to masking extreme anomalies in a single dimension due to the dragging effect of some low-risk indicators, resulting in average misjudgment. However, this formula, through the amplification mechanism of the exponential function, makes the risk factors with larger values ​​occupy an absolute dominant position in the calculation weight, thereby ensuring that the scoring results can keenly capture and lock the biggest weakness in the entire risk system. This design can effectively identify those hidden high-risk components that have not yet experienced a resonance outbreak, but whose individual indicators have deteriorated significantly.

[0086] Furthermore, as a preferred method, the risk scores for the first and second components can be calculated separately using the two methods described above, and then summed and averaged to obtain the final component risk score. The core purpose of summing and averaging the first component risk score based on the residual safety margin dissipation theory and the second component risk score based on the maximum risk potential dominance theory is to achieve precise complementarity in risk assessment dimensions by utilizing the differences in their mathematical logic. The first scoring model employs product-coupled logic, which is extremely sensitive to the dynamic explosive force when multiple indicators deteriorate simultaneously, but has a blind spot due to insufficient response when a single indicator is abnormal. The second scoring model, on the other hand, employs exponential dominance logic, which can forcibly lock in the static destructive force when a single indicator breaks through its limit, precisely filling the detection blind spot of the product model. By fusing the two through arithmetic averaging, a complementary architecture combining dynamic resonance and static fallback is constructed. This complementarity ensures that the final score can both keenly warn of complex disasters caused by the superposition of internal and external troubles and effectively prevent risk omissions due to extreme collapse of a single factor.

[0087] Step S105: Compare the component risk score with the preset security threshold, and perform graded warnings or automatic blocking operations on open source components whose component risk scores are higher than the preset security threshold.

[0088] In step S105, the calculated component risk score is compared with a preset security threshold to determine the security status of the open-source component. If the component risk score is higher than the preset security threshold, it indicates that the component has unacceptable risks, and the control mechanism is triggered.

[0089] Specifically, differentiated strategies are implemented based on the extent to which a component's risk score exceeds a preset safety threshold: For components with risk scores slightly above the safety threshold but within a controllable range, tiered warnings are issued, generating risk alerts and pushing them to the relevant developers' review lists to prompt manual intervention. For components with risk scores significantly above the safety threshold and meeting the circuit breaker criteria, automatic interception is implemented, directly blocking references to the component in the software build or integration pipeline, thereby preventing high-risk components from entering the production environment.

[0090] In summary, combining Figure 2The technical solution proposed in this application first establishes a multi-source heterogeneous data acquisition channel. Based on the frequency of index changes, the multi-dimensional feature data of open-source components are deconstructed over time, dividing them into slow evolution sequences carrying long-term trends and fast mutation sequences carrying sudden anomalies, thereby constructing a heterogeneous feature sequence set. On this basis, a trend inertia index combining regression slope and signal-to-noise ratio weights is calculated for the slow evolution sequences to quantify the structural decay degree of the components; for the fast mutation sequences, an instantaneous pulse index combining second-order difference and exponential deviation is calculated to quantify the impact energy of sudden events. Subsequently, a pre-trained long short-term memory network model is used to process the above time-series vectors to output the basic risk probability. Furthermore, a nonlinear calculation model based on the residual safety margin dissipation theory or the maximum risk potential dominance theory is adopted to deeply couple the basic risk probability with the trend inertia index and the instantaneous pulse index, ultimately generating a component risk score that takes into account both historical statistical patterns and the current physical state. Through the strategy of frequency domain orthogonal decomposition and explicit encoding of physical features, the feature interference and accuracy deviation problems caused by homogeneous modeling in existing technologies are effectively solved. By deconstructing the mixed signal into two sets of sequences, slow and fast, the scheme physically isolates the mutual noise interference between long-term and short-term indicators, preventing high-frequency fluctuations from masking low-frequency decay trends or smoothing out sudden abnormal signals. Specifically, the introduction of the trend inertia exponent enables the model to keenly capture the hidden, gradual decay in long-term indicators, while the introduction of the instantaneous impulse exponent ensures the model's instantaneous response to avalanche-like sudden changes in short-term indicators. Furthermore, by explicitly introducing these two physical exponents into the probability output of the neural network for nonlinear correction, the scheme overcomes the numerical saturation and feature dilution defects inherent in single models. This ensures that, in the face of a complex and ever-changing open-source ecosystem, whether it's gradual architectural decay or sudden security attacks, the system can output accurate and interpretable risk warning results.

[0091] Figure 3 This is a structural block diagram of a component risk prediction system based on time-series prediction provided in one embodiment of this application. The system includes at least the following modules:

[0092] The feature extraction module is used to collect multidimensional feature data from open-source components and deconstruct the data over time based on the frequency of change of each feature's indicators, thereby constructing a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences.

[0093] The vector generation module is used to calculate the trend inertia index, which reflects the long-term decline trend, and the instantaneous pulse index, which reflects the short-term abnormal fluctuation, based on the slow evolution sequence and the fast mutation sequence in the heterogeneous feature sequence set, respectively, so as to generate the time series prediction input vector.

[0094] The model prediction module is used to input the time-series prediction input vector into the pre-trained long short-term memory network model to perform time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within a preset time window in the future.

[0095] The scoring calculation module is used to calculate and generate the final component risk score based on the basic risk probability, trend inertia index, and instantaneous pulse index.

[0096] The security warning module is used to compare the component risk score with the preset security threshold, and to perform graded warnings or automatic blocking operations on open source components whose component risk scores are higher than the preset security threshold.

[0097] For relevant details, please refer to the above method implementation examples.

[0098] Figure 4 This is a block diagram of an electronic device provided in one embodiment of this application. The device includes at least a processor 401 and a memory 402.

[0099] Processor 401 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 401 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 401 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 401 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 401 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0100] Memory 402 may include one or more computer-readable storage media, which may be non-transitory. Memory 402 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in memory 402 is used to store at least one instruction, which is executed by processor 401 to implement the timing-based component risk prediction method provided in the method embodiments of this application.

[0101] In some embodiments, the electronic device may also optionally include: a peripheral device interface and at least one peripheral device. The processor 401, memory 402, and peripheral device interface can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface via a bus, signal line, or circuit board. Indicatively, peripheral devices include, but are not limited to: radio frequency circuits, touch displays, audio circuits, and power supplies.

[0102] Of course, electronic devices may also include fewer or more components, and this embodiment does not limit this.

[0103] Optionally, this application also provides a computer-readable storage medium storing a program that is loaded and executed by a processor to implement the time-series prediction-based component risk prediction method of the above method embodiments.

[0104] Optionally, this application also provides a computer product including a computer-readable storage medium storing a program that is loaded and executed by a processor to implement the time-series prediction-based component risk prediction method of the above-described method embodiments.

[0105] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0106] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for predicting the risk of a component based on time series prediction, characterized in that, The method includes: Collect multidimensional feature data from open-source components and deconstruct them over time based on the frequency of change of each feature's indicators to construct a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences; Based on the slow-evolutionary sequences and fast-mutation sequences in the heterogeneous feature sequence set, a trend inertia index reflecting long-term decline trends and a transient impulse index reflecting short-term abnormal fluctuations are calculated respectively to generate a time-series prediction input vector, including: The trend inertia index is a physical indicator that quantifies the stability and irreversibility of a slow-evolutionary sequence continuing to evolve along the current direction of decline at the current moment. The formula for calculating the trend inertia index is as follows: ； In the formula, represents the trend inertia index at the moment, represents the linear slope obtained by linear regression fitting of data of the slow evolution sequence within a preset sliding window ending at the current moment, and respectively represent the mean and standard deviation of all data of the slow evolution sequence within the sliding window, is a tiny constant to prevent the denominator from being zero;​ The instantaneous pulse index is a physical indicator that quantifies the burst energy and acceleration deviation of a fast mutation sequence caused by a sudden event at the current moment; the formula for calculating the instantaneous pulse index is as follows: ； In the formula, express The instantaneous pulse index at time t, Indicating rapid mutation sequences in The value of the moment. Indicating rapid mutation sequences in The first difference value at time t; Indicating rapid mutation sequences in The second difference value at time; and These represent the global mean and global standard deviation of the fast mutation sequence over its entire historical lifespan, respectively. This refers to the acceleration weighting coefficient; The time-series prediction input vector is input into a pre-trained long short-term memory network model to perform time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within a future preset time window. The final component risk score is calculated and generated based on the basic risk probability, the trend inertia index, and the instantaneous pulse index, including: The component risk score is calculated using the following formula: ； in, This represents the calculated component risk score. This represents the theoretical upper limit of the scoring system. Indicates the basic risk probability. Indicates the damping coefficient. and These are the trend inertia index and the instantaneous pulse index, respectively. The component risk score is compared with a preset security threshold, and open-source components with a risk score higher than the preset security threshold are subject to tiered warnings or automatic blocking.

2. The component risk prediction method based on time series prediction according to claim 1, characterized in that, The time-scale deconstruction based on the frequency of change of each feature includes: The frequency of change of the index refers to the degree of fluctuation of a certain feature value within a preset sliding time window, which is obtained by calculating the ratio of the standard deviation to the mean of a certain feature sequence within the window. A frequency threshold is pre-set as the dividing boundary, and the frequency of change of each characteristic index is compared with the frequency threshold one by one. For features whose calculated frequency of change is lower than the frequency threshold, it indicates that the feature fluctuates less and the trend is stable, and they are identified as high inertia indicators. Features whose frequency of change is higher than the threshold indicate that the feature fluctuates violently and is sensitive to sudden events, and are therefore identified as high-volatility indicators.

3. The component risk prediction method based on time series prediction according to claim 2, characterized in that, The construction of the heterogeneous feature sequence set, which includes slow-evolutionary sequences and fast-mutation sequences, includes: For data identified as having high inertia, smoothing and denoising are performed to filter out high-frequency random noise in order to retain the long-term trend terms, and the data are arranged in chronological order to generate a slow evolution sequence. For data identified as high volatility indicators, the original volatility amplitude and extreme points of the data are retained, without excessive smoothing, and arranged in chronological order to generate a rapid mutation sequence. The slow evolution sequence and the fast mutation sequence are aligned in the time dimension, together forming a heterogeneous feature sequence set.

4. The component risk prediction method based on time series prediction according to claim 1, characterized in that, The step of calculating the trend inertia index reflecting long-term decline trends and the instantaneous impulse index reflecting short-term abnormal fluctuations based on the slow evolution sequences and fast mutation sequences in the heterogeneous feature sequence set, respectively, to generate the time series prediction input vector includes: For each time step in the time series, the normalized original multidimensional feature data of the current moment is extracted as the basic feature vector. The calculated trend inertia index and instantaneous pulse index are added to the end of the basic feature vector in a fixed index order to form an expanded joint feature vector. The joint feature vector is used as the input vector for the generated time series prediction.

5. The component risk prediction method based on time series prediction according to claim 1, characterized in that, The step of inputting the time-series prediction input vector into a pre-trained long short-term memory network model for time-series dependency analysis captures the long-term dependencies between indicators and outputs the basic risk probability of the component within a future preset time window, including: An initial deep neural network architecture including a long short-term memory network layer, a fully connected layer, and an output layer is established, and a training sample set is constructed based on the historical full set of open source component behavior data; The input to the training samples is the sequence of time-series prediction input vectors generated by the component within the historical observation window; the output label is whether a security vulnerability disclosure or maintenance blocking event actually occurred in the component within a subsequent time window. During training, the sample set is input into the initial network, the binary cross-entropy loss between the network output value and the true label is calculated, and the gradient is calculated using the backpropagation algorithm over time. The weight matrix and bias terms of the network are iteratively updated through the Adam optimizer. When the loss function of the model on the validation set converges to the preset threshold, the iteration is stopped and the model parameters are locked to obtain the long short-term memory network model. The time-series prediction input vector is input into a long short-term memory network model for time-series dependency analysis. The long short-term memory network model processes the hidden state after passing through the time step through the Sigmoid activation function of the output layer and performs normalization mapping to output the basic risk probability of the component within a future preset time window.

6. A component risk prediction system based on time series forecasting, characterized in that, include: The feature extraction module is used to collect multidimensional feature data from open-source components and deconstruct the data over time based on the frequency of change of each feature's indicators, thereby constructing a heterogeneous feature sequence set containing slow evolution sequences and fast mutation sequences. The vector generation module is used to calculate the trend inertia index reflecting long-term decline trends and the instantaneous impulse index reflecting short-term abnormal fluctuations, respectively, based on the slow evolution sequence and the fast mutation sequence in the heterogeneous feature sequence set, to generate a time series prediction input vector, including: The trend inertia index is a physical indicator that quantifies the stability and irreversibility of a slow-evolutionary sequence continuing to evolve along the current direction of decline at the current moment. The formula for calculating the trend inertia index is as follows: ； In the formula, express The trend inertia index at any given moment. This indicates that for the slow-evolving sequence up to the current time... The slope of the straight line obtained by performing linear regression fitting on the data within the preset sliding window. and Let represent the mean and standard deviation of all data in the slow evolution sequence within the sliding window, respectively. To prevent tiny constants with a denominator of zero; The instantaneous pulse index is a physical indicator that quantifies the burst energy and acceleration deviation of a fast mutation sequence caused by a sudden event at the current moment; the formula for calculating the instantaneous pulse index is as follows: ； In the formula, express The instantaneous pulse index at time t, Indicating rapid mutation sequences in The value of the moment. Indicating rapid mutation sequences in The first difference value at time t; Indicating rapid mutation sequences in The second difference value at time; and These represent the global mean and global standard deviation of the fast mutation sequence over its entire historical lifespan, respectively. This refers to the acceleration weighting coefficient; The model prediction module is used to input the time-series prediction input vector into a pre-trained long short-term memory network model for time-series dependency analysis, capture the long-term dependency relationship between indicators, and output the basic risk probability of the component within a future preset time window. The scoring calculation module is used to calculate and generate the final component risk score based on the basic risk probability, the trend inertia index, and the instantaneous pulse index, including: The component risk score is calculated using the following formula: ； in, This represents the calculated component risk score. This represents the theoretical upper limit of the scoring system. Indicates the basic risk probability. Indicates the damping coefficient. and These are the trend inertia index and the instantaneous pulse index, respectively. The security warning module is used to compare the component risk score with a preset security threshold, and to perform graded warnings or automatic blocking operations on open source components whose component risk scores are higher than the preset security threshold.

7. An electronic device, characterized in that, The device includes a processor and a memory; the memory stores a program that is loaded and executed by the processor to implement a component risk prediction method based on time-series prediction as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a program that, when executed by a processor, is used to implement a component risk prediction method based on time-series prediction as described in any one of claims 1 to 5.

Images