Software supply chain security asynchronous scanning and intelligent analysis system and method

Abstract

The invention provides a software supply chain security scanning and intelligent analysis system and method, and the system comprises a main assembly line module which carries out the parallel execution of a packaging deployment task group and a security scanning task group, and asynchronously triggers a downstream scanning assembly line after the deployment of a main assembly line is completed; the asynchronous scanning module is used for independently carrying out dependent check scanning in a downstream scanning assembly line; the security agent module calls an artificial intelligence large model to analyze a scanning result, including vulnerability availability judgment, description simplification, configuration file security analysis and structured analysis data output; the report generation module is used for automatically generating a structured analysis report based on the data returned by the security agent module and distributing the structured analysis report; all the modules interact through parameter transmission and API calling, and asynchronous triggering serves as control logic on the whole. According to the method, the problem of main flow blockage caused by a synchronous scanning mode in the prior art can be effectively solved, and the problems of high false alarm rate, abstract and difficult description, insufficient coverage of configuration safety blind areas and the like of a dependency check report can be effectively solved.

Description

Technical Field

[0001] This application relates to the field of software security technology, and more specifically to an asynchronous scanning and intelligent analysis system for software supply chain security. Background Technology

[0002] In the software development field, continuous integration (CI) and continuous deployment (CD) have become standard practices in modern software engineering, aiming to accelerate software delivery and ensure code quality and stability. However, with the increasing complexity of the software supply chain, the security of third-party dependencies has become a significant risk factor. Existing software supply chain security management solutions, such as the method for automatically detecting Java third-party dependency vulnerabilities proposed in patent CN118296606A, and the DevSecOps method implemented in container orchestration clusters described in patent CN120315804A, while improving the efficiency and automation of dependency vulnerability detection to some extent, still have significant technical shortcomings in practical applications, including: Security scans often block the main pipeline: Existing technologies typically perform security scans in a synchronous mode, meaning that security scan tasks are directly embedded in the traditional CI / CD pipeline. While this simplifies process integration, it also introduces a critical problem—the execution of scan tasks can block the main pipeline process. This is especially problematic in large projects where dependency checks can take hours or even longer, severely impacting the efficiency of continuous integration and deployment.

[0003] High false positive rate: Currently widely used dependency checking tools, such as Dependency-Check, often contain a large number of false positives in their scan results. This is because traditional scanning tools mainly rely on version number matching, ignoring the actual use case of the project and lacking a comprehensive judgment of the project context. As a result, even some theoretically exploitable vulnerabilities are marked as potential threats in the real environment. This not only increases the workload of the security team but also reduces the development team's trust in the scan results, thereby affecting the efficiency and effectiveness of vulnerability remediation.

[0004] Poor report readability: These tools typically output scan reports in JSON format, which is easy for machines to read and process, but extremely inconvenient for human review. The reports contain numerous fields, obscure descriptions, and lack localized Chinese interpretations and remediation suggestions, making it difficult for developers to quickly understand the nature of the vulnerabilities and the priority of remediation, thus reducing the report's practical value.

[0005] Security blind spots in configuration: Existing technical solutions fail to adequately consider security at the software configuration level. Taking Spring Boot as an example, many projects use advanced features such as the Actuator, Swagger API documentation tools, and Gateway. However, these configurations often contain potential security vulnerabilities, such as improper exposure of Actuator endpoints, lack of authentication mechanisms for Swagger APIs, and incorrect gateway configurations. Although these issues are not traditional CVE vulnerabilities, they can still lead to serious security vulnerabilities and are even more difficult to detect and protect against than known CVEs, thus constituting a hidden blind spot in software supply chain security.

[0006] Given the aforementioned technical challenges, existing solutions urgently require a more efficient, accurate, and easier-to-understand and respond-to software supply chain security management mechanism. Summary of the Invention

[0007] To overcome the limitations of existing technologies, this invention proposes an asynchronous scanning and intelligent analysis system and method for software supply chain security based on an artificial intelligence large model. On the basis of the traditional security scanning process, it introduces a middle-layer backend service, an asynchronous triggering mechanism, and an artificial intelligence recognition module to achieve integrated processing of vulnerability screening, configuration detection, and report output, effectively reducing interference from unexploitable vulnerabilities and improving the accuracy and delivery efficiency of security detection.

[0008] The technical solution of this application is as follows: One aspect of this application provides a software supply chain security scanning and intelligent analysis system, comprising: The main pipeline module is used to execute the packaging and deployment task group and the security scanning task group in parallel. After the main pipeline completes deployment, it is decoupled from the main process through an asynchronous triggering mechanism, and the downstream scanning pipeline is triggered asynchronously. The asynchronous scanning module independently performs dependency checks in the downstream scanning pipeline. After receiving the file name, token, and project title parameters, it independently downloads and decompresses the file, performs dependency checks to generate a JSON report, and uploads the report to the backend service. The security intelligent agent module calls on a large artificial intelligence model to analyze the scan results, determine the exploitability of vulnerabilities, simplify the description, analyze the security of configuration files, and output structured analysis data. The report generation module automatically generates and distributes structured analysis reports based on the data returned by the security intelligent agent module; the modules interact with each other through parameter passing and API calls, and the overall control logic is asynchronous triggering.

[0009] In one embodiment of this application, the security scanning task group is responsible for: packaging a JAR file and uploading it to the MinIO object storage system, obtaining a token for uploading the file, asynchronously triggering the downstream scanning pipeline using the build job instruction, passing three parameters: file name, MinIO token, and project title, and setting wait: false and propagate: false to make the main process return immediately, unaffected by the scanning duration.

[0010] In one embodiment of this application, the asynchronous scanning module utilizes the MinIO object storage system to upload and download files. Specific operations include: obtaining an access token by calling the MinIO Web.Login method using the curl command; calculating the size information of the file to be uploaded; uploading the file to the object storage system using the MinIO PUT method; using the curl command to call the MinIO zip interface to download and decompress the compressed file package; and specifying the parameters of Dependency-Check in offline scanning mode to improve scanning accuracy and efficiency.

[0011] In one embodiment of this application, the security intelligent agent module performs intelligent analysis by calling a large artificial intelligence model based on the Transformer architecture, specifically including: determining the exploitability of vulnerabilities; simplifying theoretical vulnerabilities into an easy-to-understand form; and analyzing high-risk defects in configuration files based on the built-in rule base, such as Spring Boot executor endpoint exposure, Swagger interface lack of authentication, and improper gateway configuration.

[0012] In one embodiment of this application, the vulnerability exploitability assessment of the security intelligent agent module includes: existence assessment based on PoC proof of concept and EXP vulnerability exploit code; and consideration of the actual operating environment and context factors of the project.

[0013] In one embodiment of this application, the report generation module converts structured data into a report in HTML or Markdown format, specifically including: an overview section displaying the total number of vulnerabilities and the number of exploitable high-risk vulnerabilities; a vulnerability list section listing the CVE number, affected components, version, exploitability assessment, priority rating, Chinese description, and remediation suggestions; and a configuration defect section centrally displaying the security analysis results of configuration files.

[0014] In one embodiment of this application, the report generation module can send the generated standardized report via email using the SMTP protocol, including the report body and a PDF attachment.

[0015] In one embodiment of this application, the asynchronous scanning module pre-downloads the latest Dependency-Check version and its data package when performing dependency check scanning, and optimizes the scan command parameters to reduce resource consumption and improve scanning efficiency.

[0016] One aspect of this application also provides a method for asynchronous scanning and intelligent analysis of software supply chain security, including the following steps: In the main pipeline, the packaging and deployment task group and the security scanning task group are executed in parallel. The security scanning task group is responsible for packaging JAR files and uploading them to the MinIO object storage system, and obtaining access tokens for uploading files. After the main pipeline is deployed, it is decoupled from the main process through an asynchronous triggering mechanism, and the downstream scanning pipeline is triggered asynchronously, passing the file name, MinIO token and project title parameters. The downstream scanning pipeline independently downloads files, performs dependency checks, generates JSON reports, and uploads them to the backend service; The backend service calls the security intelligent agent module, uses a large artificial intelligence model to analyze the report, identify and determine the exploitability of vulnerabilities, simplify the vulnerability description, check the security of the configuration file, and output structured analysis results. A standardized analysis report is automatically generated and sent based on the structured analysis results.

[0017] In one embodiment of this application, the security scanning task group is responsible for packaging JAR files and uploading them to the MinIO object storage system, obtaining a token for uploading files, asynchronously triggering the downstream scanning pipeline using the build job instruction, passing three parameters: file name, MinIO token, and project title, and setting wait: false and propagate: false to ensure that the main process returns immediately, unaffected by the scanning duration.

[0018] The advantages of this invention are as follows: This system and method achieve seamless integration of software supply chain security scanning and intelligent analysis through an asynchronous triggering mechanism, effectively reducing the waiting time of the main process and improving overall efficiency.

[0019] The security intelligence module utilizes advanced artificial intelligence technology for vulnerability analysis and exploitability assessment, greatly improving the accuracy and usability of scan results. Meanwhile, the report generation module can automatically generate easy-to-understand standardized reports, facilitating rapid problem location and remediation, and further ensuring the security of the software supply chain.

[0020] By pre-downloading the latest scanning tools and data packages and optimizing scanning command parameters, the system can perform scanning tasks more efficiently, reduce resource consumption, and improve scanning speed, providing a faster and safer guarantee for software development.

[0021] In addition, sending standardized reports via email ensured the timely delivery of analysis results and enhanced team collaboration and problem response capabilities.

[0022] Overall, this solution significantly improves the intelligence and efficiency of software supply chain security scanning, and is of great value to software security protection. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings: Figure 1 Overall architecture diagram of the asynchronous scanning and intelligent analysis system for software supply chain security; Figure 2 Flowchart of asynchronous scanning and intelligent analysis methods for software supply chain security; Figure 3 Flowchart for secure intelligent agent processing. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] One embodiment of this application proposes an asynchronous scanning and intelligent analysis system for software supply chain security based on a large artificial intelligence model. By introducing intermediate backend services, asynchronous triggering mechanisms, and artificial intelligence recognition modules on the basis of traditional security scanning processes, an automated and intelligent software supply chain security analysis system is constructed.

[0027] The software supply chain security asynchronous scanning and intelligent analysis system based on an AI-powered big data model comprises a mainline module, an asynchronous scanning module, a security agent module, and a report generation module. The mainline module executes packaging, deployment, and security scanning tasks in parallel; the asynchronous scanning module downloads files, performs dependency checks, and generates raw reports; the security agent module uses the AI-powered big data model to analyze vulnerabilities and configurations; and the report generation module outputs standardized reports and sends them via email. Modules interact through parameter passing (such as filenames and tokens) and API calls, operating on an asynchronous triggering principle to ensure the main process is not blocked.

[0028] See the overall system architecture. Figure 1 This demonstrates the module composition and data flow. Starting from the parallel phase of the main pipeline module, the security scanning group uploads files to the MinIO object storage system (a lightweight, high-performance object storage service compatible with the S3 protocol), triggering the asynchronous scanning pipeline; the asynchronous scanning pipeline downloads the files, scans, and then uploads the report to the backend service; the backend service calls the security agent to process the data and generate a report for push. Specifically: The main pipeline module is used to execute the packaging and deployment task group and the security scanning task group in parallel. After the main pipeline completes deployment, it asynchronously triggers the downstream scanning pipeline, thereby decoupling from the main process through the asynchronous triggering mechanism.

[0029] The asynchronous scanning module is used to perform dependency checks independently in the downstream scanning pipeline. This includes independently downloading and decompressing the file after receiving the filename, token, and project title parameters, performing dependency checks to generate a JSON report, and uploading the report to the backend service.

[0030] The security intelligent agent module calls a large artificial intelligence model through backend services to analyze the scan results. It is used to perform semantic understanding and vulnerability exploitability judgment on the scan results, and combine configuration files (such as Spring Boot's Actuator, Swagger, Gateway, etc.) to perform security baseline analysis and output structured analysis data.

[0031] The report generation module is used to automatically generate structured analysis reports based on the data returned by the security intelligent agent module and distribute them to relevant personnel via email or push notification.

[0032] The system's modules interact through parameter passing (such as filenames, tokens, and task IDs) and API calls. The overall control logic is asynchronous triggering, ensuring that the main process can continue to execute even when security scanning takes a long time, thereby achieving the goals of "asynchronous scanning tasks, intelligent result processing, and readable report output".

[0033] By applying the technical solution of this embodiment, the Software Supply Chain Security Scanning and Intelligent Analysis System solves the main process blocking problem caused by synchronous scanning mode in existing technologies, as well as technical problems such as high false positive rate, abstract and difficult-to-understand descriptions, and insufficient coverage of configuration security blind spots. The asynchronous scanning module independently performs dependency checks in the downstream pipeline, avoiding the impact of long-term scanning on the main process and improving the efficiency of continuous integration. The security agent module calls the large model to judge vulnerability exploitability and simplify descriptions, significantly reducing the false positive rate and improving the readability of reports and the remediation recommendations. Configuration file security analysis fills the blind spots of traditional tools and enhances the overall security of the application. The report generation module automatically generates and pushes reports based on the structured data returned by the agent, ensuring that developers can understand the scan results in a timely and accurate manner. Overall, this system achieves efficient, accurate, and automated software supply chain security scanning through asynchronous triggering and artificial intelligence analysis, improving the delivery quality and security of DevOps processes.

[0034] In a further embodiment, the security scanning task group is responsible for: packaging the JAR file and uploading it to the MinIO object storage system, obtaining the token for uploading the file, asynchronously triggering the downstream scanning pipeline using the build job instruction, passing three parameters: file name, MinIO token, and project title, and setting wait: false and propagate: false to make the main process return immediately, unaffected by the scanning duration.

[0035] The `build job` command, within the Jenkins continuous integration tool environment, is used to trigger build tasks. By configuring a specified job (pipeline task), specific build, test, or deployment operations can be executed. In the system of this application, this command is used to asynchronously trigger the downstream security scan pipeline, ensuring that the main process is not blocked.

[0036] Additionally, in the Jenkins build job command, the `wait: false` parameter specifies whether the triggered downstream scan pipeline should wait for its completion. Setting it to `false` means no waiting, allowing the main process to return immediately, unaffected by the execution time of the downstream pipeline. The `propagate: false` parameter specifies whether to pass the parameters of the main pipeline to the downstream pipeline. Setting it to `false` means that parameters will not be automatically passed; they must be received and used in the downstream pipeline through specific parameter definitions.

[0037] In this embodiment, the security scanning task group executes in parallel within the main pipeline, responsible for packaging JAR files and uploading them to the MinIO object storage system, while simultaneously obtaining the unique token required for file upload. Subsequently, it triggers the downstream asynchronous scanning pipeline by calling the Jenkins build job command, passing the filename, token, and project title as parameters. The `wait: false` and `propagate: false` attributes are specifically set to ensure that the initiation of the security scanning task does not hinder the immediate return of the main process, and even if subsequent scans are time-consuming, it does not affect the delivery efficiency of continuous integration. This asynchronous mechanism decouples the main process from the scanning task, avoiding deployment delays caused by scan waiting, and significantly improving the speed and smoothness of DevOps continuous integration. Furthermore, after receiving the file and parameters, the downstream pipeline downloads and decompresses the file, performs dependency checks, and uploads the generated JSON report to the backend service for in-depth analysis by the subsequent security intelligence module. All these operations are performed while the main process continues to run, achieving true parallel processing and improving the overall security assessment efficiency of the software supply chain.

[0038] Furthermore, in one embodiment, the asynchronous scanning module utilizes the MinIO object storage system for file upload and download operations. Specifically, this includes: First, obtaining an access token by calling the MinIO Web.Login method using the curl command (a command-line tool used to transfer data to or from a server). This design ensures the security and access control of the file upload and download process. Second, calculating the size information of the file to be uploaded to prepare for subsequent uploads. Next, uploading the file to the object storage system using the MinIO PUT method to achieve file storage and management. Then, in the downstream pipeline, using the curl command to call the MinIO zip interface, carrying the access token and object path, to download and decompress the compressed file package for security scanning. Finally, specifying the parameters of Dependency-Check in offline scanning mode, such as --disableRetireJS, --disableNodeJS, and --noupdate, not only improves the accuracy and efficiency of the scan but also reduces the dependence on network resources, making the scanning process more stable and reliable. Through the above design, the asynchronous scanning module effectively decouples file upload and download from scanning tasks, avoiding blockage of the main process and improving the overall efficiency and accuracy of software supply chain security analysis.

[0039] The Web.Login method, as described above, is a method for authentication and obtaining access tokens. In this invention, this method is invoked using the curl command to obtain an access token for uploading files from the MinIO object storage system.

[0040] The PUT method is an HTTP request method used to upload data to a server. In this invention, a JAR file is uploaded to the object storage system using the curl command, carrying the access token and file size of the MinIO object storage system.

[0041] The zip interface is a file compression interface provided by the MinIO object storage system. In this invention, the downstream pipeline uses the curl command to call this interface to download the compressed JAR file package and decompress it to perform dependency checks.

[0042] Dependency-Check is an open-source software component vulnerability scanning tool used to identify known vulnerabilities in software dependencies. In this invention, it serves as the core tool of the asynchronous scanning module, used to perform software supply chain security scans and generate raw JSON format scan reports.

[0043] Furthermore, in one embodiment, the security intelligent agent module performs intelligent analysis by calling a large artificial intelligence model based on the Transformer architecture, including: determining the exploitability of vulnerabilities; simplifying theoretical vulnerabilities into easily understandable forms; and analyzing high-risk defects in configuration files based on a built-in rule base. High-risk defects include issues such as Spring Boot executor endpoint exposure, Swagger interface lack of authentication, and improper gateway configuration.

[0044] In this embodiment, the security agent module utilizes a large-scale AI model based on the Transformer architecture to perform in-depth analysis and optimization of the software supply chain security scan results. The core of this design lies in the fact that the large model not only assesses the exploitability of each CVE listed in the JSON reports generated by tools like Dependency-Check, but also translates abstract technical descriptions into language easily understood by developers, significantly reducing the difficulty of report interpretation. Furthermore, the security agent module possesses the capability to analyze the security baseline of configuration files, identifying and flagging common high-risk configuration defects in the Spring Boot framework, such as improper exposure of executor endpoints, security vulnerabilities in Swagger documentation, and improper gateway configurations. Through this intelligent analysis, this embodiment significantly reduces the false positive rate in security scan reports, while enhancing the report's guidance and readability, helping development teams quickly locate and fix real security issues, and effectively improving the overall security protection level of the software supply chain.

[0045] It is worth noting that although the Transformer architecture was chosen as the large model in this embodiment, other types of deep learning models or traditional machine learning algorithms can be used to accomplish similar tasks in other embodiments, as long as the model can meet the requirements of context understanding and text generation. Regardless of the model chosen, the design of this embodiment aims to achieve a more efficient and intelligent software supply chain security scanning and analysis process, thereby promoting the implementation and deepening of the DevSecOps concept in actual development and operation.

[0046] In summary, Spring Boot is a popular Java application framework for building microservice architectures, simplifying the development, configuration, and deployment of applications. However, Spring Boot applications may contain configuration flaws, such as exposed executor endpoints, unauthenticated Swagger interfaces, and incorrect gateway configurations. While these flaws may not have CVE numbers, they can still pose security risks.

[0047] Swagger APIs are tools for describing RESTful APIs that can automatically generate API documentation and test code. If Swagger APIs are not configured with authentication, anyone can access and test the API, potentially discovering and exploiting potential security vulnerabilities.

[0048] Furthermore, in one embodiment, the exploitability assessment of vulnerabilities by the security agent module specifically includes existence evaluation based on Proof of Concept (PoC) and Exploit (EXP) code, while also considering the actual operating environment and contextual factors of the project. This design enables the system to more accurately assess the actual threat level of vulnerabilities in the software supply chain. By comprehensively analyzing the verifiability of vulnerabilities and their exploitability in a specific project environment, it effectively reduces the false positive rate and improves the accuracy of security assessments. By incorporating project contextual information, such as the operating environment, network configuration, and usage scenarios, the security agent module can intelligently determine which seemingly existing vulnerabilities are actually unexploitable due to configuration limitations or other protective measures. This significantly improves the quality and practicality of security reports, helping R&D teams focus more on the security risks that truly need attention and remediation, and improving the efficiency and effectiveness of software supply chain security management.

[0049] Furthermore, in one embodiment, the report generation module converts structured data into a report in HTML or Markdown format, including: an overview section displaying the total number of vulnerabilities and the number of exploitable high-risk vulnerabilities; a vulnerability list section listing the CVE number, affected components, version, exploitability assessment, priority rating, Chinese description, and remediation recommendations; and a configuration defect section centrally displaying the security analysis results of configuration files.

[0050] In this embodiment, the report generation module converts the structured data returned by the security agent into an HTML or Markdown report. The report includes an overview section that clearly displays the total number of vulnerabilities and the number of exploitable high-risk vulnerabilities in the software supply chain, providing a clear overview of the security situation. The vulnerability list section details the CVE number, affected components and their version information, and includes exploitability assessments, priority ratings, Chinese descriptions, and remediation suggestions derived from large-scale AI model analysis, enabling developers to quickly locate problems and take action. The configuration defect section summarizes the results of security analysis of software configuration files, specifically pointing out potential risks such as exposed Spring Boot executor endpoints, unauthenticated Swagger interfaces, and gateway configuration errors, filling a gap in traditional scanning tools in this area. In this way, the report not only improves readability and usability but also promotes the efficient implementation of security practices, ensuring the security and stability of the software supply chain.

[0051] Furthermore, in this embodiment, the report generation module can send the generated standardized report via email using the SMTP protocol, including the report body and a PDF attachment.

[0052] Furthermore, in this embodiment, when performing dependency check scanning, the asynchronous scanning module pre-downloads the latest Dependency-Check version and its data package, while optimizing the scan command parameters to reduce resource consumption and improve scanning efficiency.

[0053] This invention also proposes an asynchronous scanning and intelligent analysis method for software supply chain security based on a large-scale artificial intelligence model, combined with... Figure 2 The following embodiments illustrate the method steps in chronological order: Step 1: Execute the package deployment and security scan task groups in parallel within the main pipeline.

[0054] Step 2: In the security scan task group, package the JAR file and upload it to the MinIO object storage system to obtain the access token for the uploaded file.

[0055] Step 3: After the main pipeline is deployed, scanning is triggered asynchronously. This asynchronous triggering mechanism decouples the process from the main workflow, including: Within the security scan task group, the `build job` command asynchronously triggers the downstream scan pipeline, passing three parameters: filename, MinIO token, and project title. Setting `wait: false` and `propagate: false` ensures the main process returns immediately, unaffected by scan duration. The downstream scan pipeline is triggered asynchronously, passing the filename and token parameters.

[0056] Step 4: In the downstream pipeline, download and decompress the file, perform dependency check scan to generate a JSON report, including independently downloading and decompressing the file from MinIO after receiving the file name, token and project title parameters, performing dependency check scan to generate a JSON report, and uploading the JSON report and configuration file to the backend service; Step 5: The backend service receives the report, encapsulates the report and configuration file data, and invokes the security agent.

[0057] Step 6: The security agent uses a large AI model to determine the exploitability of vulnerabilities, simplifies their descriptions, checks the security of configuration files, and outputs structured JSON data.

[0058] Step 7: The backend service generates standardized reports based on structured data and sends them via email according to specific logic.

[0059] The present invention will be further described in detail below in combination with the system and method: First, the system is deployed in the Jenkins continuous integration environment, using Groovy scripts to define the pipeline. The main pipeline modules adopt a parallel structure, enabling the parallel execution of the packaging and deployment task group (including Docker build and Kubernetes deployment) and the security scanning task group, ensuring that security scanning does not affect deployment speed. In the security scanning task group, the JAR file packaging step uses shell commands to locate the JAR file in the target directory, copies it to a temporary directory, and compresses it into a tar file. Then, it uses the curl command to obtain a token for the MinIO object storage system (using the Web.Login method), calculates the file size, and uploads the file (using the PUT method, carrying the token and file size). Asynchronous scanning is triggered using the build job command, setting propagate: false and wait: false to ensure that the main process is not blocked. The parameters passed include the filename, token, and project title.

[0060] Combination Figure 1 As can be seen, the "Mainstream Pipeline Module" is marked as A, representing the Jenkins main pipeline; the "Asynchronous Scanning Module" is marked as B, representing the downstream pipeline; the "Security Agent Module" is marked as C, representing the backend service call model; and the arrows indicate data flow, such as asynchronous triggering from A to B.

[0061] Secondly, the asynchronous scanning module executes in the downstream pipeline: The file download step uses curl to call MinIO's zip interface, carrying the token and object path, to download and decompress the compressed package; the dependency check scan step pre-downloads Dependency-Check, executes the dependency-check.sh command, specifying the parameters --project, --scan path, --format JSON, --out report file, --data directory, --disableRetireJS, --disableNodeJS, and --noupdate to ensure offline scanning. After scanning, temporary files are deleted and MinIO objects are removed. The report is uploaded to the backend service using curl POST, carrying the project name and user email address.

[0062] Combination Figure 2 The method flow is as follows, where step 4 is marked as D, indicating a dependency check scan process. The input is the decompressed JAR file, and the output is a JSON report.

[0063] Then, the security agent module is implemented in the backend service (e.g., using the Python FastAPI framework): it receives JSON reports and configuration files (such as application.yml), and calls the large AI model for analysis. The large model processing includes vulnerability exploitability assessment (based on evidence such as PoC existence and project context), description simplification (converting to easily understandable Chinese), and configuration file checking (matching built-in rule bases, such as executor exposure, missing Swagger certification, and improper gateway configuration). It outputs structured JSON, including an overview, a list of vulnerabilities, and configuration flaws. Specifically, in the Spring Boot project scanning process, scanning is triggered asynchronously after the main pipeline completes deployment. After the downstream generates a report, the backend service calls the large model to filter false positives and analyze the configuration, generating a report and pushing it via email. The entire process does not interrupt the main delivery.

[0064] Combination Figure 3 The security intelligent agent processing flow shows the steps from inputting a report to outputting JSON, with E marked as the vulnerability assessment section and F as the configuration analysis section.

[0065] Finally, end-to-end reporting automation: The report generation module renders HTML / Markdown reports, including an overview (total number of vulnerabilities, number of exploitable high-risk vulnerabilities), tables (CVE, component, version, exploitability, priority, Chinese description, and fixes).

[0066] This invention improves DevOps delivery efficiency by over 30% by designing an asynchronous scan triggering mechanism to avoid main process blocking. It reduces false positives through security intelligence analysis, identifies exploitable vulnerabilities through special marking, and enhances the targeted nature of remediation. Integration with Spring Boot configuration files allows for security analysis coverage of blind spots, supports various high-risk defects, and improves application security. Automated report generation and delivery effectively improve report readability and support efficient decision-making.

[0067] In summary, this invention effectively addresses the inefficiencies and technical blind spots in traditional software supply chain management by constructing an asynchronous scanning and intelligent analysis system for software supply chain security based on a large-scale artificial intelligence model. Through asynchronous security scanning, intelligent vulnerability analysis, optimized scanning tool usage, and automated report generation, it significantly improves the security and delivery efficiency of the software supply chain, providing a novel solution for security management in software development and continuous integration environments.

[0068] Partial explanation of the present invention: Jenkins: Jenkins continuous integration tool, an open-source automation server used for building, testing, and deploying software. CVE: Common Vulnerabilities and Exposures, a publicly available software vulnerability identification system.

[0069] PoC: Proof of Concept, a code example used to verify the exploitability of a vulnerability.

[0070] EXP: Exploit, a type of vulnerability code used for actual attacks.

[0071] K8S: Kubernetes, an open-source container orchestration platform for automating the deployment and management of containerized applications.

[0072] JSON: JavaScript Object Notation, a lightweight data interchange format.

[0073] API: Application Programming Interface, a protocol that defines the interaction between software components.

[0074] Actuator: An executor, a monitoring and management endpoint module provided by Spring Boot.

[0075] Swagger: Swagger API documentation tool, an open-source framework for generating RESTful API documentation.

[0076] Gateway: A gateway is an API routing and management component provided by Spring Cloud.

[0077] CVSS: Common Vulnerability Scoring System, a standard for assessing the severity of vulnerabilities.

[0078] DevOps: Development and Operations, a software development and operations practice.

[0079] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0080] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A software supply chain security scanning and intelligent analysis system, characterized in that, Comprise: A main pipeline module for executing a packaged deployment task group and a security scanning task group in parallel, the main pipeline triggers a downstream scanning pipeline asynchronously after completing the deployment, and the decoupling with the main process is realized through an asynchronous triggering mechanism; An asynchronous scanning module for performing dependency check scanning independently in the downstream scanning pipeline, including independently downloading and decompressing files after receiving the file name, token, and project title parameters, performing dependency check scanning to generate a JSON report, and uploading the report to a backend service; A security agent module for calling an artificial intelligence large model to analyze the scanning results, including judging vulnerability exploitability, simplifying descriptions, and analyzing configuration file security, and outputting structured analysis data; A report generation module for automatically generating a structured analysis report based on the data returned by the security agent module and distributing it; The modules interact through parameter passing and API calling, and the overall control logic is asynchronous triggering.

2. The software supply chain security scanning and intelligent analysis system of claim 1, wherein the security scanning task group is responsible for: packaging JAR files and uploading them to a MinIO object storage system, obtaining a token for the uploaded files, using a build job instruction to trigger a downstream scanning pipeline asynchronously, passing three parameters: file name, MinIO token, and project title, setting wait: false and propagate: false, so that the main process returns immediately and is not affected by the scanning time.

3. The software supply chain security scanning and intelligent analysis system of claim 1, wherein the asynchronous scanning module uses the MinIO object storage system to upload and download files, including: obtaining an access token by calling the Web.Login method of the MinIO through a curl command; calculating the size information of the file to be uploaded; uploading the file to the object storage system through the PUT method of the MinIO; using the curl command to call the zip interface of the MinIO, carrying the access token and object path, to download and decompress the file package; in offline scanning mode, specify the parameters of Dependency-Check to improve scanning accuracy and efficiency. The security agent module performs intelligent analysis by calling an artificial intelligence large model based on the Transformer architecture, including: judging vulnerability exploitability; simplifying theoretical vulnerabilities into understandable forms; analyzing high-risk defects in the configuration file based on an internal rule library, including issues such as Spring Boot executor endpoint exposure, Swagger interface without authentication, improper gateway configuration, etc. The security agent module's judgment of vulnerability exploitability specifically includes: existence evaluation based on PoC concept verification and EXP exploit code; considering the actual running environment and contextual factors of the project.

4. The software supply chain security scanning and intelligent analysis system of claim 1, 2 or 3, wherein, ​ 5. The software supply chain security scanning and intelligent analysis system according to any one of claims 1 to 4, characterized in that, ​ 6. The software supply chain security scanning and intelligent analysis system according to any one of claims 1 to 5, characterized in that, The report generation module converts structured data into an HTML or Markdown format report, including: a total overview section showing the total number of vulnerabilities and the number of exploitable high risks; a vulnerability list section listing CVE numbers, affected components, versions, exploitability judgments, priority ratings, Chinese descriptions, and repair suggestions; and a configuration defect special area that centrally displays the security analysis results of the configuration file.

7. The software supply chain security scanning and intelligent analysis system according to any one of claims 1 to 6, characterized in that, The report generation module can send the generated standardized report by SMTP protocol, including the report body and a PDF attachment.

8. The software supply chain security scanning and intelligent analysis system according to any one of claims 1 to 7, characterized in that, The asynchronous scanning module pre-downloads the latest Dependency-Check version and its data packet while performing the dependency check scan, and optimizes the scanning command parameters to reduce resource occupation and improve scanning efficiency.

9. A method for software supply chain security asynchronous scanning and intelligent analysis, characterized in that, The method comprises the following steps: The packaging and deployment task group and the security scanning task group are executed in parallel in the main pipeline, wherein the security scanning task group is responsible for packaging JAR files and uploading them to the MinIO object storage system to obtain an access token for the uploaded files; After the main pipeline completes the deployment, the scanning is triggered asynchronously to decouple the main process, including: using the build job instruction or the RabbitMQ message queue to trigger the downstream scanning pipeline asynchronously, passing the file name, MinIO token, and project title parameters to ensure that the main process is not affected by the scanning time; The downstream scanning pipeline downloads the files according to the received file name and token, and performs dependency check scanning, including: after receiving the file name, token, and project title parameters, the files are independently downloaded and decompressed from MinIO, the dependency check scanning is performed to generate a JSON report, and the JSON report and configuration file are uploaded to the backend service; The backend service receives the report, calls the security agent module, analyzes the report using an artificial intelligence model, identifies and judges the exploitability of the vulnerabilities, simplifies the vulnerability description, checks the security of the configuration file, and outputs structured analysis results; Based on the structured analysis results, a standardized analysis report is automatically generated and sent.

10. The software supply chain security asynchronous scanning and intelligent analysis method of claim 9, wherein, The security scanning task group is responsible for packaging JAR files and uploading them to the MinIO object storage system to obtain a token for the uploaded files, using the build job instruction to trigger the downstream scanning pipeline asynchronously, passing the file name, MinIO token, and project title parameters, setting wait: false and propagate: false to ensure that the main process returns immediately and is not affected by the scanning time.

Images