Software supply chain security detection method and system based on large model agent

Abstract

The invention discloses a software supply chain security detection method and system based on a large model agent, and relates to the technical field of network security. According to the method, a large-scale software supply chain knowledge graph is constructed based on a preprocessed large-scale software supply chain data set, and meanwhile, a software supply chain field large model is obtained; and after receiving a software supply chain question, directly generating a corresponding answer in the software supply chain security detection field by the software supply chain field large model in real time, or retrieving the large-scale software supply chain knowledge graph based on scene classification, and generating a corresponding answer in the software supply chain security detection field in combination with a retrieval result. According to the method, the problems of information fragmentation, knowledge updating lag, high manual analysis cost, low automation degree, high false alarm rate and the like in software supply chain security management of a traditional method are solved, and intelligent support is provided for constructing a credible, safe and transparent software supply chain system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a software supply chain security detection method and system based on a large model agent. BACKGROUND

[0002] In recent years, with the increasing complexity and diversification of software supply chains, the risks of software supply chain security have become increasingly prominent. Software supply chain security not only has the characteristics of low attack threshold, diverse attack methods, and strong concealment, but also can affect the security of the downstream of the software supply chain, significantly expanding the risk range, and becoming the focus of widespread attention in the industry. Therefore, software supply chain security detection is of great significance to ensure the security of our country's software.

[0003] Knowledge graph plays a key role in software supply chain security detection. It integrates multi-source data such as software components, dependency relationships, version evolution, supplier information, and known vulnerabilities through structured integration, builds a global knowledge network, and realizes the visualization and traceability of complex associations in the supply chain. With the help of knowledge graph, it can quickly identify the transmission dependencies between components, locate the scope of vulnerability influence, and discover hidden third-party risk components, improving the threat tracing and impact analysis capabilities. At the same time, with the release and application of artificial intelligence large models represented by ChatGPT, large models have been widely applied in various industries. By utilizing the text fusion, knowledge reasoning, and event summarization capabilities of large models, security personnel can conduct more in-depth detection and analysis of each link in the software supply chain, and identify and respond to security threats.

[0004] Currently, the way large models retrieve knowledge graphs can be divided into semantic parsing and information retrieval. The semantic parsing method maps unstructured natural language questions into a series of structured logical forms, such as semantic graphs or high-level query languages (such as SPARQL, Cypher, etc.), so as to execute precise queries on the knowledge graph. However, this method requires high accuracy for semantic parsing, and the generated query statements often fail to execute due to syntax or logical errors, limiting the overall accuracy. The information retrieval method maps natural language questions and entities and relationships in the knowledge graph to the same low-dimensional vector space, and matches them by calculating the semantic similarity between the question and the candidate triplets, and obtains the candidate answers in a ranking manner. This method has strong semantic generalization ability, but when faced with large-scale knowledge graphs, it has problems such as large computational overhead, low retrieval efficiency, and candidate space explosion, affecting real-time performance and scalability. SUMMARY

[0005] The present application aims at the above-mentioned problems existing in the prior art, proposes a software supply chain security detection method and system framework based on a large model agent, proposes a method for retrieving a large-scale software supply chain knowledge graph based on a large model based on scene classification, constructs a bidirectional collaborative optimization mechanism of software supply chain knowledge graph and domain large model, and provides efficient and reliable intelligent support for software supply chain security governance.

[0006] In one aspect, the present application discloses a software supply chain security detection method based on a large model agent, comprising the following steps: Collecting software supply chain security related data, pre-processing the collected data, and obtaining a large-scale software supply chain data set; Based on the large-scale software supply chain data set, a large-scale software supply chain knowledge graph is constructed, and a software supply chain domain large model is obtained; After receiving a software supply chain problem, the software supply chain domain large model directly generates the corresponding answer in the software supply chain security detection field in real time, or retrieves the large-scale software supply chain knowledge graph based on scene classification, and generates the corresponding answer in the software supply chain security detection field in combination with the retrieval result.

[0007] In another aspect, the present application further provides a software supply chain security detection system based on a large model agent, comprising the following modules: The data set generation module is used for collecting software supply chain security related data, pre-processing the collected data, and obtaining a large-scale software supply chain data set; The construction module is used for constructing a large-scale software supply chain knowledge graph based on a large-scale software supply chain data set, and obtaining a software supply chain domain large model; The answer generation module is used for, after receiving a software supply chain problem, the software supply chain domain large model directly generates the corresponding answer in the software supply chain security detection field in real time, or retrieves the large-scale software supply chain knowledge graph based on scene classification, and generates the corresponding answer in the software supply chain security detection field in combination with the retrieval result.

[0008] As described above, due to the adoption of the above technical solutions, the present application has the following advantages: The application constructs a software supply chain security detection framework method and system based on a large-scale knowledge graph and a large-scale intelligent agent, gathers massive software supply chain basic data, constructs a large-scale software supply chain knowledge graph with four dimensions of software components, vulnerabilities, development and security events as the core, continuously collects data to realize dynamic updating and incremental construction of the software supply chain graph, and forms a knowledge network covering the whole life cycle of software; through large model content generation, feedback optimization, knowledge graph continuous updating optimization, etc., a bidirectional knowledge injection closed loop between the knowledge graph and the large model is formed, and a bidirectional collaborative optimization mechanism of the software supply chain knowledge graph and the field large model is realized. Finally, according to the different requirements of response speed and answer accuracy of actual application scenes, two answer generation operation modes of large model direct generation mode and large model retrieval knowledge graph generation mode are designed, and the problems of information fragmentation, knowledge updating lag, high artificial analysis cost, low automation degree and high false positive rate in the traditional method in software supply chain security management are solved, which provides intelligent support for building a credible, safe and transparent software supply chain system. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 Fig. 1 is a flowchart of a software supply chain security detection method based on a large model intelligent agent provided by the application; Figure 2 Fig. 2 is a flowchart of data acquisition and model construction provided by the application.

[0010] Figure 3 Fig. 3 is a flowchart of a retrieval knowledge graph generation mode provided by the application.

[0011] Figure 4 Fig. 4 is a flowchart of software supply chain field large model fine-tuning provided by the application.

[0012] Figure 5 Fig. 5 is a structural diagram of a software supply chain security detection system based on a large model intelligent agent provided by the application.

[0013] Figure 6 Fig. 6 is a structural diagram of a security detection platform provided by the application. DETAILED DESCRIPTION

[0014] In order to make the personnel in the art better understand the technical solutions of the application, the technical solutions of the application will be described clearly and completely below in combination with the drawings of the application. Other similar embodiments obtained by the personnel in the art without creative labor on the basis of the embodiments in the application shall belong to the protection scope of the application.

[0015] In this invention, an agent is an abstract concept in the field of artificial intelligence that is capable of thinking and interacting with its environment. In this embodiment, a large vertical model oriented towards the software supply chain is obtained as the brain for agent decision-making and generation.

[0016] In addition, in this embodiment of the invention, a prompt refers to information provided by a computer system or program to the user for interactive input, thereby using natural language processing to guide the interaction between the user and the intelligent system.

[0017] Example 1 This invention provides a software supply chain security detection method based on a large model intelligent agent, which constructs a two-way collaborative optimization mechanism of software supply chain knowledge graph and domain large model.

[0018] like Figure 1 As shown, the method includes: Step S01: Collect software supply chain security-related data and preprocess the collected data to obtain a large-scale software supply chain dataset.

[0019] In a preferred embodiment, web crawling technology is used to collect large-scale data related to software supply chain security from the Internet, such as... Figure 2 As shown, this ensures the diversity and comprehensiveness of the data. Software supply chain security-related data includes textual data such as information on software developers, vendors, software documentation, development tools, software dependencies, vulnerability information, and reports on software supply chain security published by various platforms. After data preprocessing such as cleaning and formatting, a large-scale software supply chain dataset is constructed. Next, a software supply chain knowledge graph and a fully parameter-trained large-scale software supply chain model are built on this multi-source heterogeneous dataset.

[0020] Step S02: Construct a large-scale software supply chain knowledge graph and obtain a large model in the software supply chain field.

[0021] First, leveraging the aforementioned large-scale software supply chain dataset, we efficiently extract entity relationship triples from structured or semi-structured data (such as CVE / NVD vulnerability databases, NPM / PyPI package metadata, SBOM software bill of materials, JSON data returned by GitHub API, security bulletin tables, etc.) using rule-based and template-driven methods. Through predefined regular expressions, XPath / CSS selectors, JSON path extractors, and other technologies, we achieve high-precision and repeatable automated information extraction.

[0022] For unstructured text data (such as security bulletin text, GitHub issue discussions, mailing lists, technical blogs, vulnerability analysis reports, etc.), deep learning-based natural language processing algorithms are used to extract entities and relations. BERT, LSTM and other deep learning algorithms for entity extraction and relation extraction are used to extract entity-relation triples. After processing such as entity alignment and knowledge fusion, a large-scale software supply chain knowledge graph is generated.

[0023] In particular, the graph node types are built around four categories: software components, vulnerabilities, development, and security events. Each category's entities and relationships are constructed to form a knowledge network covering the entire software lifecycle. This supports in-depth software supply chain security analysis from four dimensions: component perspective (dependency analysis), vulnerability perspective (impact spread), development behavior perspective (maintenance activity, contributor credibility), and security event perspective (attack pattern identification, historical event comparison).

[0024] Secondly, using the aforementioned large-scale software supply chain dataset, we selected large model training tools such as Hugging Face Transformers and Firefly to train open-source large models such as LLaMA 3 or ChatGLM-2 with full parameters.

[0025] It should be noted that, in a preferred embodiment, for cost considerations, the large model's full-parameter training step only needs to be performed once. In another preferred embodiment, for efficiency improvement, the large model training step can be skipped, and an open-source large model can be directly used to replace the domain-specific large model. Subsequently, the large model can be fine-tuned through a large model optimization mechanism to enhance its knowledge in the software supply chain domain. This invention does not impose specific limitations on this, as long as a software supply chain domain large model is ultimately obtained and determined.

[0026] With a large-scale software supply chain knowledge graph and a large-scale model of the software supply chain domain, a corresponding answer in the field of software supply chain security testing can be generated directly in real time upon receiving a software supply chain question. However, since this direct generation mode is only applicable to relatively simple software supply chain questions and cannot be applied to complex questions or scenarios with high accuracy requirements (such as compliance audits and supply chain risk assessments), this invention further improves the answer generation mode.

[0027] Step S03: Based on scenario classification, retrieve the knowledge graph of the large-scale software supply chain, and use the retrieval results to generate answers to related questions in the field of software supply chain security testing.

[0028] The improved embodiment of the present invention provides a large-scale software supply chain model that employs two operating modes: a direct generation mode and a knowledge graph generation mode for large-scale model retrieval. The application scenarios for these two modes are as follows: (1) Direct generation mode: suitable for scenarios with high requirements for response speed and relatively common or simple problems (such as whether npm package XXX has known vulnerabilities?), etc., which are answered quickly by the large model in the software supply chain field based on its internalized knowledge; (2) Knowledge graph generation mode: It is suitable for scenarios with high accuracy and high credibility requirements (such as compliance audit and supply chain risk assessment). First, relevant facts are retrieved from the large-scale software supply chain knowledge graph, and then the large model in the software supply chain field is combined with the retrieval results to generate rigorous and traceable answers.

[0029] After acquiring a large-scale software supply chain knowledge graph and a large model of the software supply chain domain, the large model is further used to retrieve the large-scale software supply chain knowledge graph. Specifically, this invention classifies common scenarios in the field of software supply chain security detection and proposes a method for retrieving large-scale software supply chain knowledge graphs based on scenario classification, such as... Figure 3 As shown, it mainly includes three parts: problem understanding and scenario retrieval, matching and calling interface tools to query the knowledge graph, and answer generation.

[0030] Specifically, this includes S301, which involves building a library of common scenarios in the field of software supply chain security testing for problem understanding and scenario retrieval, thereby selecting appropriate scenarios for software supply chain problems.

[0031] This paper summarizes common scenarios in the software supply chain field and, based on the types of nodes in the software supply chain knowledge graph (with software components, vulnerabilities, development, and security incidents as the core), constructs a scenario library for software supply chain security testing.

[0032] For each scenario, detailed query steps corresponding to the scenario in the large-scale software supply chain knowledge graph are listed; all scenarios in the software supply chain security detection scenario library are used as context knowledge construction prompts (Prompts) and input into the software supply chain domain big model. The software supply chain domain big model understands and reasons about the input software supply chain related issues and retrieves the scenario library to select the applicable scenario.

[0033] S302, Construct a basic query interface library for a software supply chain knowledge graph, and use interface tools to query the knowledge graph: After completing the scenario retrieval, the corresponding query steps are input into the software supply chain domain model via a prompt. The software supply chain domain model, based on the description of each step and the functional description of each interface in the software supply chain knowledge graph basic query interface library, matches the appropriate interface tool to complete the query of the knowledge graph. This step is repeated multiple times until all query steps in the scenario are completed.

[0034] Furthermore, for the nodes and relationships of the four major types (software components, vulnerabilities, development and security events) in the large-scale software supply chain knowledge graph, query interfaces are encapsulated and detailed text descriptions are added for large models in the software supply chain domain to perform functional identification and invocation.

[0035] As a preferred embodiment, the general interface includes interface 1: locating map nodes and obtaining node details.

[0036] The component-related query interfaces include: Interface 1: query the corresponding version of the component; Interface 2: query the known vulnerabilities of the component; Interface 3: query the component developer; Interface 4: query the open source license information of the component.

[0037] The interfaces for vulnerability-related queries include: Interface 1: query basic vulnerability information; Interface 2: query the scope of components affected by the vulnerability; Interface 3: query information related to the vulnerability issuer.

[0038] The interfaces for developing related queries include: Interface 1: Query developer basic information (nationality, region, etc.); Interface 2: Query software component distribution platform; Interface 3: Query software components released by the developer / development platform.

[0039] The interfaces for querying software supply chain security incidents include: Interface 1: Query open source software risk announcements; Interface 2: Query development tool risk announcements; Interface 3: Query software update channel security incidents; Interface 4: Query the security status of open source project maintainers.

[0040] S303: Based on the query results, construct a prompt instruction as contextual knowledge and input it into the large model to generate the answer.

[0041] This paper utilizes a large-scale model in the software supply chain domain to achieve common scenario retrieval in software supply chain security testing and to construct a basic query interface library for software supply chain knowledge graph matching. This enables knowledge graph retrieval tasks for various software supply chain security testing scenarios. Finally, based on the query results, a prompt containing contextual knowledge is constructed and input into the large-scale model to generate answers corresponding to the software supply chain questions.

[0042] Furthermore, examples of the query process for some scenarios are as follows.

[0043] Scenario 1: Vulnerability risks of XX software components.

[0044] The corresponding knowledge graph query steps include: (1) Locate the component node in the knowledge graph; (2) Query the edge and node information associated with the software component node, such as query the component version information, known vulnerabilities of the component, and component developer information.

[0045] Scenario 2: Details of the XX vulnerability, and the scope of software components affected.

[0046] The corresponding knowledge graph query steps include: (1) Locate the vulnerability node in the knowledge graph; (2) Query the edge and node information associated with the vulnerable node, such as basic vulnerability information, software components affected by the vulnerability, vulnerability release platform information, etc.

[0047] Scenario 3: Dependencies and vulnerabilities of software component XX version XX.

[0048] The corresponding knowledge graph query steps include: (1) Locate the component node of the software component in the knowledge graph; (2) Query the version node corresponding to the component and the components it depends on; (3) Check the vulnerability risks of the dependent component packages according to the steps in Scenario 1.

[0049] Scenario 4: The latest software components released by the XX software release platform and their vulnerability risks.

[0050] The corresponding knowledge graph query steps include: (1) Locate the software publishing platform component node in the knowledge graph; (2) Query the edge and node information associated with the software publishing platform node, such as software components, developers, risk announcements, security incidents, etc.; (3) Check the vulnerability risks of the dependent component packages according to the steps in Scenario 1.

[0051] The above are merely illustrative examples. The specific scenario type, interface type, and corresponding query steps can be comprehensively set according to the applicable problems, functions, and other factors of the specific implementation.

[0052] Step S04: Based on the large-scale software supply chain knowledge graph, perform content verification and feedback optimization on the large-scale model in the software supply chain field.

[0053] Based on the aforementioned large-scale software supply chain knowledge graph, the content generated by the large-scale software supply chain model using a direct generation mode is further validated offline by searching the software supply chain knowledge graph. For data that fails validation, a large-scale model fine-tuning dataset in the form of <question, answer> is constructed for periodic fine-tuning of the large-scale software supply chain model. This process allows for content validation and feedback optimization of the large-scale software supply chain model. Figure 4 As shown, this can ultimately optimize the answer generation performance of large models in the software supply chain domain under the direct generation mode.

[0054] The specific process includes: S401 records the content and questions generated by the large model in the software supply chain field in the direct generation mode, denoted as <question i, direct answer i>; S402, Input question i into the large model, use the large model to retrieve the knowledge graph generation mode output content, record it as the retrieval answer i, and represent it as <question i, direct answer i, retrieval answer i>; S403, verify whether the facts and logic described in the direct answer i are consistent with the retrieved answer i. If they are contradictory, the verification fails; otherwise, the verification passes. S404. For cases where the validation fails, construct a large model fine-tuning dataset W of the form <question i, retrieve answer i>, and use methods such as LORA and P-Tuning to fine-tune and train the large model in the software supply chain domain on dataset W to better adapt it to software supply chain related tasks.

[0055] Furthermore, the method provided in this embodiment of the invention may also include step S05, which involves using a large model in the software supply chain domain to complete and continuously update the knowledge graph of the software supply chain.

[0056] After obtaining the optimized software supply chain domain model using the aforementioned methods, it is possible to further utilize the inherent knowledge of the software supply chain domain model to automatically infer and complete the missing node relationships in the software supply chain knowledge graph. The specific process includes: S501 first generates a set of target entity pairs and a set of candidate relationships from the constructed software supply chain knowledge graph.

[0057] Existing data is read from the constructed software supply chain knowledge graph, including various entities (such as software components, versions, suppliers, vulnerabilities, licenses, etc.) and their known relationships, semantic types based on entities, and identification of potentially related but not yet connected entity pairs in the graph. For example, potential combinations such as "Component A - Component B" (to determine if there is a dependency or derivative relationship) and "Component C - Vulnerability D" (to determine if there is a vulnerability association) are filtered out to form a set of target entity pairs to be verified {(h, t)}. At the same time, a set of candidate relationships {r} is generated based on the existing relationship types of these entity pairs.

[0058] S502, construct prompts, that is, construct structured natural language prompts for each target entity pair (h, t) and each candidate relation r.

[0059] For example, construct the following prompt: In the software supply chain, is there a "vulnerability exists" relationship between component "Log4j" and vulnerability "CVE-2021-44228"? Please answer yes or no.

[0060] S503 uses a large model in the software supply chain domain to reason and judge prompts.

[0061] The constructed prompts are input into a pre-trained large-scale model of the software supply chain domain. The large-scale model of the software supply chain domain performs zero-shot inference based on the knowledge contained in its internal parameters and outputs a judgment on whether the triple (h, r, t) is true (such as "yes" or "no").

[0062] S504 analyzes the judgment results of large models in the software supply chain field and assesses their confidence level.

[0063] The inference and judgment output text of the large model is parsed to extract the inference and judgment results. At the same time, the confidence of the inference and judgment is evaluated by methods such as generation probability and consistency of multiple sampling.

[0064] S505 filters high-confidence results and uses them for knowledge completion.

[0065] In a preferred embodiment, a confidence threshold (e.g., ≥0.9) is set to retain only highly confident "yes" results and filter out low-confidence or ambiguous judgments to ensure the quality of knowledge completion. Finally, the filtered triples are added as new relations to the original knowledge graph to complete the knowledge completion.

[0066] The software supply chain security detection method provided by this invention does not rely on external knowledge retrieval. Instead, it relies on the parameterized knowledge and semantic reasoning capabilities of a large model. Through systematic prompt instruction design and batch reasoning, it achieves efficient and accurate knowledge completion. Example 2 This embodiment is a software supply chain security detection system based on a large-scale intelligent agent model. The system is used to implement any of the aforementioned methods for vulnerability mining of instant messaging private protocols, such as... Figure 5 As shown, the system includes the following modules: The dataset generation module is used to collect data related to software supply chain security, preprocess the collected data, and obtain a large-scale software supply chain dataset. The module is used to build a large-scale software supply chain knowledge graph based on a large-scale software supply chain dataset, and at the same time obtain a large model in the software supply chain field. The answer generation module is used to generate corresponding answers in the field of software supply chain security testing in real time from a large model in the software supply chain domain after receiving a software supply chain question, or to search a large-scale software supply chain knowledge graph based on scenario classification and generate corresponding answers in the field of software supply chain security testing based on the search results.

[0067] In another preferred embodiment, the system further includes a data update module, used to perform content verification and feedback optimization on the large model of the software supply chain domain based on the large model software supply chain knowledge graph, and / or use the large model of the software supply chain domain to supplement and continuously update the knowledge graph of the software supply chain.

[0068] Furthermore, the security testing platform structure corresponding to the software supply chain security testing system based on large-scale intelligent agents is as follows: Figure 6 As shown, the platform includes a basic support layer, a large model layer, a domain large model optimization layer, a software supply chain knowledge base construction layer, a large model-knowledge graph collaborative optimization layer, and an infrastructure layer.

[0069] The infrastructure layer includes data preprocessing modules, front-end display modules, and databases. The basic support layer includes physical servers, GPU servers, and large model service providers.

[0070] The large model layer includes existing general large models as well as domain-specific large models obtained through training.

[0071] Domain-wide model optimization layer, including tools for fine-tuning the domain-wide model.

[0072] The software supply chain knowledge base construction layer includes a large model fine-tuning dataset sub-module, a software supply chain knowledge graph sub-module, a knowledge graph basic query interface library sub-module, and a software supply chain scenario library sub-module, etc. The large model-knowledge graph collaborative optimization layer includes a large model knowledge graph completion sub-module, a large model generated content verification and optimization sub-module, and a large model operation mode optimization sub-module, etc. In a preferred embodiment, these sub-modules can be obtained or implemented through the aforementioned corresponding methods.

[0073] Example 3 This embodiment provides a non-transitory computer-readable storage medium storing computer instructions that enable a computer to implement the software supply chain security detection method based on large model intelligent agents described in any of the foregoing embodiments.

[0074] Example 4 This embodiment provides a computer program product, which includes a computer program that, when executed by a processor, is used in the software supply chain security detection method based on large model intelligent agents described in any of the foregoing embodiments.

[0075] In summary, this invention constructs a software supply chain security detection framework method and system based on a large-scale knowledge graph and a large-scale intelligent agent. This includes the construction of a large-scale software supply chain knowledge graph, the acquisition of a large-scale model in the software supply chain domain, the retrieval of the large-scale software supply chain knowledge graph based on scenario classification, the optimization of the large-scale model in the software supply chain domain, and the knowledge completion of the software supply chain knowledge graph based on the large model. Based on this architecture, by aggregating massive amounts of basic software supply chain data, a large-scale software supply chain knowledge graph is constructed with four core dimensions: software components, vulnerabilities, development, and security events. Continuous data collection enables dynamic updates and incremental construction of the software supply chain graph, forming a knowledge network covering the entire software lifecycle. Simultaneously, a vertical large-scale model oriented towards the software supply chain domain is trained with full parameters, serving as the decision-making and generation brain for the intelligent agent. Then, supported by a large-scale software supply chain knowledge graph and a domain-specific large model, the content generated by the large model is verified by retrieving information from the knowledge graph. Inconsistent or missing content is used to construct a fine-tuning dataset for the large model, enabling continuous optimization and knowledge alignment. Simultaneously, the domain-specific large model is used to complete and improve the missing content in the knowledge graph. Combined with the graph's dynamic update capabilities, a continuous update and optimization mechanism for the software supply chain knowledge graph is constructed, achieving intelligent completion and continuous evolution of the knowledge graph. Through content verification and feedback optimization by the large model and continuous updating and optimization of the knowledge graph, a two-way knowledge injection closed loop is formed between the knowledge graph and the large model, realizing a two-way collaborative optimization mechanism between the software supply chain knowledge graph and the domain-specific large model. Finally, based on the different requirements for response speed and answer accuracy in actual application scenarios, two answer generation and operation modes were designed: a direct generation mode of large models and a knowledge graph generation mode of large models. These modes solve the problems faced by traditional methods in software supply chain security management, such as information fragmentation, lagging knowledge updates, high cost of manual analysis, low degree of automation, and high false alarm rate. This provides intelligent support for building a trustworthy, secure, and transparent software supply chain system.

[0076] The present invention has been described in detail above with reference to the accompanying drawings. However, it should be noted that the examples described above are merely preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of the claims of the present invention.

[0077] All features disclosed in this specification, or steps in all disclosed methods or processes, may be combined in any way, except for mutually exclusive features and / or steps. This invention is not limited to the specific embodiments described above. This invention extends to any new feature or any new combination disclosed in this specification, as well as any new step or any new combination of any disclosed method or process.

Claims

1. A software supply chain security detection method based on a large model agent, characterized in that, Comprising the following steps: Collecting software supply chain security related data, preprocessing the collected data to obtain a large-scale software supply chain dataset; Based on the large-scale software supply chain dataset, a large-scale software supply chain knowledge graph is constructed, and a software supply chain field large model is obtained; After receiving the software supply chain problem, the software supply chain field large model directly generates the corresponding answer in the software supply chain security detection field in real time, or the software supply chain field large model retrieves the large-scale software supply chain knowledge graph based on scene classification, and generates the corresponding answer in the software supply chain security detection field combined with the retrieval result.

2. The software supply chain security detection method based on a large model agent according to claim 1, wherein, The nodes of the large-scale software supply chain knowledge graph include four types of software components, vulnerabilities, development and security events, and entities and relationships of each type are constructed according to the four types.

3. The software supply chain security detection method based on a large model agent according to claim 1 or 2, characterized in that, Based on the large-scale software supply chain dataset, a large-scale software supply chain knowledge graph is constructed, including, For structured or semi-structured data in the large-scale software supply chain dataset, a rule and template driven method is used to efficiently extract entity relationship triples; for unstructured text data in the large-scale software supply chain dataset, a deep learning based natural language processing algorithm is used for entity and relationship extraction, and a deep learning algorithm is used to extract entity relationship triples; The extracted entity relationship triples are aligned and fused to generate a large-scale software supply chain knowledge graph.

4. The software supply chain security detection method based on a large model agent according to claim 1, wherein, Select a large model training tool to train an open source large model based on a large-scale software supply chain dataset, thereby obtaining a software supply chain field large model.

5. The software supply chain security detection method based on a large model agent according to claim 1, wherein, When the software supply chain problem is simple and the response speed of the answer is high, the software supply chain field large model directly generates the corresponding answer in the software supply chain security detection field in real time; When the software supply chain problem is complex and the answer is required to be highly reliable, the large-scale software supply chain knowledge graph is retrieved based on scene classification, and the corresponding traceable answer in the software supply chain security detection field is generated combined with the retrieval result.

6. The software supply chain security detection method based on a large model agent according to claim 1, wherein, After receiving the software supply chain problem, the software supply chain field large model retrieves the large-scale software supply chain knowledge graph based on scene classification, and generates the corresponding answer in the software supply chain security detection field combined with the retrieval result, including, A software supply chain security detection field scene library is constructed for problem understanding and scene retrieval, and the scene is input as a context to construct a prompt instruction, while the software supply chain problem is understood and the corresponding scene is selected; The query steps corresponding to the scene are input through the prompt instruction, and a software supply chain knowledge graph basic query interface library is constructed, which is matched and called to query the knowledge graph; The query result is input as context knowledge to construct a prompt instruction to generate an answer.

7. The software supply chain security detection method based on a large model agent according to claim 1, wherein, It also includes content verification and feedback optimization of the software supply chain field large model based on the large model software supply chain knowledge graph, and / or knowledge completion and continuous updating of the software supply chain knowledge graph using the software supply chain field large model.

8. The software supply chain security detection method based on a large model agent according to claim 7, wherein, The content verification and feedback optimization of the software supply chain field large model based on the large model software supply chain knowledge graph includes, Record the content and problems generated by the software supply chain domain large model in the direct generation mode, and generate the first data set {<question, direct answer>}; Input the question into the large model and output the content using the large model knowledge graph retrieval generation mode, record it as a retrieval answer, and generate the second data set {<question, direct answer, retrieval answer>}; Check whether the description of the fact and logic of the direct answer is consistent with the retrieval answer. If there is a contradiction, the check fails, otherwise the check passes; For the case where the check fails, construct the third data set {<question, retrieval answer>} as a large model fine-tuning data set, and fine-tune the software supply chain domain large model on the large model fine-tuning data set.

9. The software supply chain security detection method based on a large model agent according to claim 7, wherein, Use the software supply chain domain large model to perform knowledge completion and continuous updating on the software supply chain knowledge graph, including, Generating a set of target entity pairs and a set of candidate relationships from the existing software supply chain knowledge graph; Constructing a structured natural language prompt instruction for each target entity pair and each candidate relationship; Inferencing and judging the constructed prompt instruction by the software supply chain domain large model; Parsing the inference and judgment output text of the software supply chain domain large model, extracting the inference and judgment result and evaluating the confidence of the inference and judgment result; According to the confidence, filter the triplets after filtering and add them to the existing software supply chain knowledge graph as new relationships to complete the knowledge completion.

10. A large model agent-based software supply chain security detection system, characterized in that, The system is used to implement the software supply chain security detection method based on the large model agent according to any one of claims 1-9, comprising the following modules: A data set generation module for collecting software supply chain security related data, preprocessing the collected data, and obtaining a large-scale software supply chain data set; A construction module for constructing a large-scale software supply chain knowledge graph based on the large-scale software supply chain data set, and obtaining a software supply chain domain large model; An answer generation module for generating a corresponding answer in the software supply chain security detection field in real time after receiving a software supply chain question, or retrieving the large-scale software supply chain knowledge graph based on scene classification, and generating a corresponding answer in the software supply chain security detection field in combination with the retrieval result.

Images