Software endogenous security evaluation and elastic defense system and method

Abstract

The invention discloses a software endogenous security evaluation and elastic defense system and method, and belongs to the technical field of software information security analysis, and the method comprises the following steps: continuously collecting multi-dimensional telemetry data such as time sequence behavior, resource consumption and dependent calling during software operation and external threat intelligence; constructing a dynamically updated behavior baseline by using a clustering algorithm based on historical normal data; comparing the real-time data with a baseline, calculating various types of anomalies, and constructing a three-dimensional risk portrait covering vulnerabilities, maintenance, permissions and behaviors for each dependency item; constructing a risk conduction graph according to a dependency calling relation, quantifying a risk conduction effect through a graph propagation algorithm, and outputting a comprehensive evaluation report for accurately positioning a risk source and a path; and finally, according to the risk level, executing an elastic layered response strategy of switching from alarm, current limiting, sandbox to fusing. According to the method, accurate and explainable evaluation and refined elastic defense of the endogenous risk during software operation are realized, and safety and service continuity are effectively balanced.

Description

Technical Field

[0001] This invention relates to the field of software information security analysis technology, and more specifically, to a system and method for assessing and resiliently defending inherent software security. Background Technology

[0002] Software information security refers to a series of measures and methods to protect software and its related information resources from illegal and malicious intrusion, theft, tampering, damage, and misuse. Therefore, the continuous enhancement of software information security helps protect users' privacy rights and improves the stability and reliability of software.

[0003] As software system complexity increases and supply chain attacks become more prevalent, traditional security detection methods based on static vulnerability scanning, signature matching, or fixed rules are struggling to address zero-day vulnerabilities, insider threats, and security risks arising from abnormal calls to normal components. Existing technologies, such as CN120744939B, attempt to conduct risk assessments by analyzing runtime software interaction data and external dependencies.

[0004] However, significant limitations still exist:

[0005] (1) It relies on “theoretical response data” that is difficult to obtain accurately in real-world environments;

[0006] (2) The risk assessment model is relatively rigid, with fixed weights and poor adaptability;

[0007] (3) The safety assessment results are poorly interpretable and it is difficult to pinpoint the specific root causes of risks;

[0008] (4) The governance methods are too simplistic (such as directly cutting off the network), which seriously affects business continuity. Summary of the Invention

[0009] In view of the problems existing in the prior art, the purpose of this invention is to provide a software intrinsic security assessment and resilient defense system and method, which realizes real-time, accurate and interpretable assessment of software security risks and triggers layered resilient defense actions, thereby maximizing business availability while ensuring security.

[0010] To solve the above problems, the present invention adopts the following technical solution.

[0011] A software intrinsic security assessment and resilient defense system and method, comprising: S100: continuously collecting multi-dimensional telemetry data of the target software during runtime, wherein the data includes at least time-series behavior data, resource consumption sequence data, dependency call graph data, and external threat intelligence data; S200: constructing and dynamically updating the behavior baseline of the target software based on the multi-dimensional telemetry data collected during historical normal operation, wherein the behavior baseline includes a normal behavior pattern library, a reasonable resource consumption range library, and a dependency call relationship whitelist; S300: comparing and analyzing the real-time collected multi-dimensional telemetry data with the behavior baseline to calculate the behavior deviation degree and resource anomaly degree. The system includes dependency call anomaly detection and constructs a multi-dimensional risk profile for each called dependency, encompassing vulnerability, maintenance health, permission compliance, and behavioral credibility dimensions. S400: Based on the dependency call graph data, a software dependency risk transmission graph is constructed. Using the multi-dimensional risk profile as the initial risk node, the transmission and convergence of risks in the graph are calculated using a graph propagation algorithm to obtain the global risk contribution of each node, and a comprehensive risk assessment result and a structured risk report are output. S500: Based on the level of the comprehensive risk assessment result, a tiered elastic defense response strategy is executed, including at least low-risk alerts, medium-risk fine-grained control, and high-risk circuit breaker isolation.

[0012] Furthermore, the specific method for constructing the normal behavior pattern library in step S200 is as follows: the historical time-series behavior data is segmented using a sliding time window, and the behavior sequences within the window are clustered using an unsupervised clustering algorithm, and the behavior sequence patterns belonging to the mainstream clusters are stored in the normal behavior pattern library.

[0013] Furthermore, the unsupervised clustering algorithm is a density-based clustering method with noise.

[0014] Furthermore, in step S300, the behavioral deviation is calculated using a dynamic time warping algorithm, which is obtained by calculating the similarity between the real-time behavioral sequence and each pattern sequence in the normal behavioral pattern library.

[0015] Furthermore, the fusion risk value of the multi-dimensional risk profile Calculated using the following formula:

[0016] in, Scoring based on vulnerability dimensions, To maintain the health score, Scoring based on permission compliance. To score the credibility of the behavior, , , , These are configurable weighting coefficients, and .

[0017] Furthermore, the graph propagation algorithm in step S400 is an improved PageRank algorithm, wherein the edge weight from node u to node v is... The calculation formula is determined by both the call frequency and the data transfer volume: ,in, For normalized call frequency, The normalized average data transfer volume, and These are weighting coefficients, and .

[0018] Furthermore, the medium-risk fine-grained control measures in step S500 include at least one of the following: rate limiting of specific dependency calls, executing specific dependency calls in a sandbox environment, and dynamically revoking unnecessary permissions for specific dependencies.

[0019] Furthermore, the high-risk circuit breaker isolation measures in step S500 include at least one of the following: blocking calls to dependencies that have been confirmed to be malicious or have serious vulnerabilities, isolating affected service instances from the service cluster, and switching to backup service instances.

[0020] Furthermore, it also includes a software intrinsic security risk assessment and resilient defense system, comprising: a data acquisition module for continuously collecting multi-dimensional telemetry data during target software runtime; a dynamic baseline learning module for constructing and updating behavioral baselines based on historical normal data; a real-time risk detection and profiling module for baseline comparison, anomaly calculation, and dependency risk profiling; a risk transmission analysis and assessment module for constructing dependency risk transmission graphs, execution graph propagation algorithms, and generating comprehensive risk assessment reports; a resilient response strategy execution module for executing layered defense response actions based on risk assessment levels; and a threat intelligence access module for acquiring external threat intelligence data.

[0021] Furthermore, it also includes a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the above method.

[0022] Compared with the prior art, the advantages of this invention are:

[0023] Abandoning idealized assumptions and aligning with reality: By replacing "theoretical data" that cannot be accurately obtained with dynamic behavioral baselines, risk assessment is based on real and observable operational conditions, significantly improving the feasibility and accuracy of the model.

[0024] The assessment is comprehensive and interpretable: it constructs a dependency risk profile from four dimensions: vulnerability, maintenance, permissions, and behavior, and uses dependency graph analysis to analyze risk transmission. This makes the assessment results no longer a single score, but a detailed report with clear sources and paths, greatly enhancing interpretability and operability.

[0025] The model has strong adaptability: the behavioral baseline can be updated with software iteration and environmental changes, and the weights of the graph propagation algorithm are adjustable, enabling the system to adapt to dynamic changes in different software architectures and threat scenarios.

[0026] The defense response is flexible and refined: it changes the traditional "one-size-fits-all" approach to network outages and provides a progressive response strategy from alarms, demotion, rate limiting, sandboxing to circuit breaker switching. While effectively curbing risks, it maximizes the continuity and availability of core businesses and achieves a balance between security and business.

[0027] Achieving proactive intrinsic security: This invention deeply integrates security analysis into the intrinsic behavior of software runtime, enabling earlier detection of anomalies caused by configuration errors, internal abuse, or supply chain attacks, thus achieving a shift from "perimeter protection" to "intrinsic security". Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the overall system architecture provided in an embodiment of the present invention;

[0029] Figure 2 This is a flowchart illustrating the dynamic behavior baseline construction and updating in an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of risk transmission analysis based on dependency graphs in an embodiment of the present invention;

[0031] Figure 4 This is a flowchart illustrating the execution logic of the elastic hierarchical response strategy in an embodiment of the present invention. Detailed Implementation

[0032] Example 1:

[0033] like Figure 1 As shown, the system of this invention mainly includes the following modules: a data collector, a dynamic baseline learning engine, a real-time risk detection engine, a dependency graph and risk transmission analysis engine, a resilient response executor, and a threat intelligence gateway. Each module communicates loosely via an internal message bus or API, working collaboratively to achieve a secure closed loop from data perception and analysis to decision-making and response.

[0034] Specifically, the data collector consists of a lightweight collection agent within the target software runtime environment (such as a host machine, virtual machine, container, or microservice instance) and a centralized data aggregation and preprocessing service. The data collector includes the collection agent and the aggregation and preprocessing service. The collection agent is responsible for collecting raw telemetry data non-intrusively or with low intrusion during software runtime using techniques such as instrumentation (e.g., Java Agent, eBPF), operating system hooking, or bypass traffic mirroring. The collection agent includes behavioral collection agents, resource collection agents, and dependency collection agents. The behavioral collection agent captures function call stacks, system call sequences, and process tree events; the resource collection agent periodically pulls or listens for pushed CPU, memory, network, and disk I / O metrics; and the dependency collection agent intercepts and records network connection (e.g., TCP / UDP), remote procedure call (RPC, such as gRPC, HTTP API), dynamic library loading, and other events to form a call relationship log. The aggregation and preprocessing service receives raw data from various brokers, performs timestamp synchronization, data format standardization (such as converting to a unified JSON or Protobuf format), deduplication and preliminary filtering, and publishes the processed structured data stream to a message queue (such as Kafka) or real-time data pipeline for downstream modules to consume.

[0035] Specifically, the dynamic baseline learning engine includes a time window manager, an unsupervised learning model library (with built-in algorithms such as DBSCAN and K-Means), and a baseline feature repository (such as a time series database or a feature vector database). The time window manager is used to divide the historical normal-phase data stream from the data collector into sliding windows of preset duration. The unsupervised learning model library is used to vectorize the behavioral sequences within the window and perform clustering, storing high-frequency, stable cluster core sequences in the normal behavior pattern library. Simultaneously, it calculates statistical features (such as mean, standard deviation, and percentiles) for resource consumption data, forming a dynamic library of reasonable resource consumption intervals. The baseline feature repository is used to persistently store the learned behavioral patterns, resource intervals, and a whitelist of dependency call relationships generated statistically from dependency data.

[0036] Specifically, the real-time risk detection engine comprises a baseline comparator, a multi-dimensional anomaly calculation unit, and a risk profile builder. The baseline comparator consumes the data stream from the data collector in real time. For behavioral sequences, it uses a dynamic time warping algorithm to calculate their similarity to all behavioral patterns in the baseline library, taking the highest value as the conformity score, which is the behavioral deviation score. For resource indicators, it checks whether their instantaneous values ​​or moving averages exceed the reasonable range defined in the baseline library, calculating the resource anomaly score. For dependency calls, it checks whether the call relationship is within a whitelist and performs outlier detection on the call frequency, calculating the dependency call anomaly score. The multi-dimensional anomaly calculation unit is the core computational component of the "real-time risk detection engine," responsible for quantitatively comparing the real-time data stream with the dynamic baseline, outputting three core security anomaly indicators: behavioral deviation score, resource anomaly score, and dependency call anomaly score. The risk profile builder aggregates information from four dimensions for each called dependency. Preferably, the risk profile builder includes: a vulnerability dimension used to query the "Threat Intelligence Gateway" in real time to obtain the CVE list and severity of libX and generate a vulnerability score; a health dimension used to calculate a health score based on the metadata of its open-source repository; a permission compliance dimension used to analyze the system calls, file accesses, network ports, etc. actually used by libX during operation and compare them with the minimum permission set required by its declared functions to calculate a compliance score; and a behavior credibility dimension used to comprehensively consider the behavior deviation, resource anomaly, and call anomaly related to the libX call to generate a behavior credibility score.

[0037] Specifically, the dependency graph and risk transmission analysis engine includes a graph builder, a graph computation engine, and a report generator. The graph builder uses dependency call events reported by the "real-time risk detection engine" as edges and software components and dependencies as nodes to build and update a directed attribute graph in memory in real time. Node attributes in the graph include their "local risk profile," while edge attributes include call frequency, average latency, etc. The graph computation engine runs an improved PageRank algorithm for risk transmission analysis. The report generator identifies the key nodes with the highest global risk contribution and the paths with the most significant risk value accumulation based on the converged graph. Combined with the anomaly indicators of the entire system, it generates a structured risk assessment report containing a comprehensive risk score, top risk items, a visualization of the transmission path, and proposed solutions.

[0038] Specifically, the resilient response executor comprises a policy resolver, an action executor cluster, and a feedback collector. The policy resolver is used to pre-define or allow users to define response policy rules. The action executor cluster contains various fine-grained execution units that can be dynamically invoked by policies; these fine-grained execution units include flow control executors, sandbox executors, access control executors, and circuit breaker executors. Flow control executors are used to implement rate limiting or connection pool isolation for specific dependency calls by issuing iptables rules or calling the service mesh API. Sandbox executors are used to redirect calls to suspicious dependencies to an isolated, secure sandbox environment using containers or lightweight virtualization technologies. Access control executors are used to dynamically revoke or downgrade unnecessary permissions for specific processes via Seccomp, AppArmor, or operating system APIs. Circuit breaker executors are used to execute the most severe responses, such as completely blocking network access to a specific IP or port, deregistering problematic instances from the service registry, or triggering failover to a backup system. The feedback collector monitors changes in system status and risk indicators after response actions are executed, feeding the effects back to the system for future policy optimization.

[0039] Specifically, the threat intelligence gateway is an adapter module responsible for communicating with external services, and it has a built-in caching mechanism. It periodically or on demand pulls, parses, and formats information such as vulnerabilities, malware hashes, and supply chain poisoning incidents from external data sources such as public vulnerability databases, commercial threat intelligence platforms, and open-source software security projects, and provides an internal query interface.

[0040] Specifically, the implementation process of this method will be illustrated using a web application based on a microservice architecture as an example.

[0041] Data Acquisition (S100): Deploy a lightweight data acquisition agent within the application server and each microservice container. The agent continuously collects: API call chains (time-sequence behavior) of each service, container resource metrics (resource consumption), and HTTP / gRPC call relationships between services (dependency graph). Simultaneously, the system periodically synchronizes vulnerability information about the frameworks used (such as Spring) and database drivers (such as MySQLConnector) from the national vulnerability database through a threat intelligence gateway.

[0042] During the operation of the target software, the following four types of real-time telemetry data are continuously collected through instrumentation or bypass monitoring:

[0043] Temporal behavioral data: including but not limited to function call sequences, system call sequences, and process / thread creation and destruction event sequences.

[0044] Resource consumption sequence data: Time-series data of CPU utilization, memory usage, network I / O traffic, and file handle count are acquired at a preset sampling frequency.

[0045] Dependency call graph data: Records the call relationships between software and third-party libraries, external components, and microservice APIs, including caller, callee, call timestamp, call context, and call frequency.

[0046] External threat intelligence data: By accessing external security databases, we can obtain vulnerability information (CVE), malware intelligence, community security announcements, and software composition analysis results related to the software's dependencies in real time.

[0047] Baseline building (S200): During the stable operation phase of the application in its initial launch period (e.g., within one week), collect all data. Figure 2 As shown, the baseline learning engine clustered the "normal" API call sequences during this period and found that sequences such as user login → querying personal information → generating a homepage are high-frequency and stable sequences, which were then stored in the behavior pattern library. Simultaneously, it was determined that during peak business hours, the CPU utilization rate of the order service normally ranged from 30% to 60%, and this was stored in the resource range library. All legitimate call relationships between services were recorded in a whitelist.

[0048] Based on multi-dimensional data collected during normal operation phases in history, a dynamic behavior baseline is constructed, specifically including:

[0049] S201: Use a sliding time window to segment historical time-series behavioral data and resource consumption sequence data.

[0050] S202: For the data within each window, use an unsupervised clustering algorithm to extract patterns, and store frequently occurring and stable behavior patterns and resource consumption intervals into a normal behavior pattern library and a reasonable resource consumption interval library.

[0051] S203: Perform statistical analysis on dependency call graph data, establish a whitelist of dependency call relationships, and record common and reasonable call paths.

[0052] S204: Set a baseline update mechanism so that when the software version is updated or the operating environment changes significantly, the above baseline library is incrementally learned and updated based on the new normal phase data.

[0053] Real-time Detection and Profile Building (S300): At a certain moment, the real-time detection engine detects that the payment service is suddenly making frequent calls to an RPC interface of an external IP that has never appeared before (abnormal dependency calls), and the memory usage of the payment service is soaring to 150% of the baseline range (abnormal resources). The engine immediately builds a risk profile for this external RPC interface dependency: a threat intelligence query shows no vulnerability records (low risk at the vulnerability level), but there is no official maintenance information (poor maintenance health), the requested permissions far exceed the payment's requirements (non-compliant permissions), and the associated behavior is abnormal (low behavioral credibility). This dependency is marked as high risk.

[0054] Specifically, S301: Compare the real-time telemetry data with the dynamic behavior baseline.

[0055] For time-series behavioral data, the dynamic time warping algorithm is used to calculate its similarity with each pattern in the normal behavior pattern library. The highest similarity is taken as the behavior conformity score, and its complement is the behavior deviation score.

[0056] For a resource consumption sequence, determine whether its real-time value exceeds the upper and lower bounds defined in the reasonable range library for resource consumption, calculate the proportion and severity of exceeding the bounds, and calculate the resource anomaly degree.

[0057] For dependent calls, check if they exist in the dependency call relationship whitelist, perform outlier detection on the call frequency, and calculate the dependency call anomaly degree.

[0058] S302: Build a multi-dimensional risk profile for each invoked dependency. The profile dimensions include:

[0059] Vulnerability Dimension: Based on external threat intelligence, summarize the number of known vulnerabilities, severity level (CVSS score), and whether there is any known exploit code for this dependency.

[0060] Health score is calculated based on the open-source repository or official information, including the last update time, recent commit frequency, and number of maintainers.

[0061] Permission compliance dimension: Analyze the actual system permissions, network permissions, file access permissions, etc. requested by the dependency, compare them with the minimum permission set required by its claimed function, and calculate the degree of permission exceeding the scope.

[0062] Behavioral credibility dimension: integrates the behavioral deviation, resource anomaly, and call anomaly related to the dependency calculated in S301.

[0063] Risk transmission analysis (S400): such as Figure 3As shown, the analysis engine constructs the current dependency graph and discovers that the suspicious RPC interface is called by the payment service, which in turn is called by the order service and the front-end gateway. Through graph propagation algorithms, it is calculated that the initial high-risk value of this suspicious node will propagate to the payment service and further affect the order service and the front-end gateway. The engine identifies the payment service → suspicious RPC interface as the critical risk path, and the payment service as the critical risk node. After comprehensive evaluation, the system determines the overall risk level to be medium-high risk.

[0064] Specifically, S401: Construct a real-time software dependency risk transmission graph using software components and dependencies as nodes and call relationships as directed edges.

[0065] S402: Assign an initial risk value to each node in the graph. This value is calculated by weighted fusion of its multidimensional risk profile.

[0066] S403: Employs an improved graph propagation algorithm to simulate the risk propagation process in a dependency graph. The algorithm considers not only the risk value of each node itself, but also:

[0067] The directionality of edges (risk propagation along the call chain).

[0068] Call frequency and data traffic (high frequency and high traffic edges have higher weight).

[0069] The centrality of a node in the global graph (such as PageRank value) indicates that nodes with higher centrality have a wider risk impact range.

[0070] S404: After multiple rounds of iterative calculations, the global risk contribution of each node is obtained, and high-risk transmission paths and key risk nodes are identified.

[0071] S405: Combining the overall behavioral deviation, resource anomaly, and global risk status of the dependency graph, output a comprehensive risk assessment score and attach a structured risk report that clearly indicates the main sources of risk, transmission paths, and possible impacts.

[0072] Elastic response (S500): such as Figure 4 As shown, the response executor, based on the policy, does not take the drastic approach of directly cutting off the payment service. Instead, it first rate-limits all network connections from the payment service to the suspicious RPC interface (e.g., reduces them to 1 call / minute) and attempts to redirect these calls to a simulated sandbox environment for observation. Simultaneously, it issues a high-level alert to the operations console, explicitly indicating that the risk lies in an external RPC dependency of the payment service and providing a transmission path diagram. Operations personnel can use this information for in-depth investigation and manual decision-making. If the suspicious interface begins returning malicious data or attempts lateral movement, the system can automatically escalate the response, isolate the payment service instance, and switch payment traffic to a backup service link.

[0073] Based on the comprehensive risk assessment score and risk report output by S400, implement a tiered defense response:

[0074] Low risk level: Generates detailed security logs and alarm notifications, which are sent to security operations personnel without interfering with software operation.

[0075] Medium risk level: Triggers fine-grained control measures, including but not limited to: rate limiting calls to specific high-risk dependencies; sandboxing and isolating them for operation; dynamically revoking unnecessary permissions; or degrading related functions.

[0076] High-risk level: Triggers circuit breaker and isolation measures, including but not limited to: immediately blocking calls to dependencies that have been identified as malicious or have serious vulnerabilities; temporarily removing affected service instances from the load balancer pool; switching to a pre-set clean backup service instance; and in extreme cases, isolating a single faulty node from the network to prevent the risk from spreading.

[0077] Specifically, in step S202, the unsupervised clustering algorithm is a density-based clustering method with noise, which can automatically identify and filter transient noise behavior during operation.

[0078] Specifically, in step S403, in the improved graph propagation algorithm, the edge weight from node u to node v... The calculation formula is:

[0079] in, For normalized call frequency, The normalized average data transfer volume, and These are weighting coefficients, and .

[0080] Specifically, the weighted fusion formula for the multidimensional risk profile is:

[0081] in, Scoring based on vulnerability dimensions, To maintain the health score, Scoring based on permission compliance. To score the credibility of the behavior, , , , These are configurable weighting coefficients, and .

Claims

1. A method for assessing and resiliently defending against software intrinsic security, characterized in that: include: S100: During the runtime of the target software, continuously collect multi-dimensional telemetry data of its runtime, including at least time-series behavior data, resource consumption sequence data, dependency call graph data, and external threat intelligence data. S200: Based on the multi-dimensional telemetry data collected during the historical normal operation phase, construct and dynamically update the behavior baseline of the target software. The behavior baseline includes a normal behavior pattern library, a reasonable resource consumption range library, and a dependency call relationship whitelist. S300: Compare and analyze the multi-dimensional telemetry data collected in real time with the behavior baseline, calculate the behavior deviation, resource anomaly and dependency call anomaly, and construct a multi-dimensional risk profile for each called dependency, including vulnerability dimension, maintenance health dimension, permission compliance dimension and behavior credibility dimension. S400: Construct a software dependency risk transmission graph based on the dependency call graph data, take the multi-dimensional risk profile as the initial risk of the node, calculate the transmission and convergence of risk in the graph through the graph propagation algorithm, obtain the global risk contribution of each node, and output the comprehensive risk assessment result and structured risk report; S500: Based on the level of the comprehensive risk assessment results, implement a tiered resilient defense response strategy, which includes at least low-risk alerts, medium-risk fine-grained control, and high-risk circuit breaker isolation.

2. The method for assessing and resiliently defending software intrinsic security according to claim 1, characterized in that: The specific method for constructing the normal behavior pattern library in step S200 is as follows: a sliding time window is used to segment the historical time-series behavior data, and an unsupervised clustering algorithm is used to cluster the behavior sequences within the window, storing the behavior sequence patterns belonging to the mainstream cluster into the normal behavior pattern library.

3. The method for assessing and resiliently defending against software intrinsic security according to claim 2, characterized in that: The unsupervised clustering algorithm is a density-based clustering method with noise.

4. The method for assessing and resiliently defending against software intrinsic security according to claim 1, characterized in that: In step S300, the behavioral deviation is calculated using a dynamic time warping algorithm, which is obtained by calculating the similarity between the real-time behavioral sequence and each pattern sequence in the normal behavioral pattern library.

5. The method for assessing and resiliently defending against software intrinsic security according to claim 1, characterized in that: The fusion risk value of the multi-dimensional risk profile Calculated using the following formula: in, Scoring based on vulnerability dimensions, To maintain the health score, Scoring based on permission compliance. To score the credibility of the behavior, , , , These are configurable weighting coefficients, and .

6. The method for assessing and resiliently defending against software intrinsic security according to claim 1, characterized in that: The graph propagation algorithm in step S400 is an improved PageRank algorithm, where the edge weight from node u to node v is... The calculation formula is determined by both the call frequency and the data transfer volume: ,in, For normalized call frequency, The normalized average data transfer volume, and These are weighting coefficients, and .

7. The method for assessing and resiliently defending against software intrinsic security according to claim 1, characterized in that: The medium-risk fine-grained control measures in step S500 include at least one of the following: rate limiting of calls to specific dependencies, execution of calls to specific dependencies in a sandbox environment, and dynamic revocation of unnecessary permissions for specific dependencies.

8. The method for assessing and resiliently defending against software intrinsic security according to claim 1, characterized in that: The high-risk circuit breaker isolation measures in step S500 include: blocking calls to dependencies that have been confirmed to be malicious or have serious vulnerabilities, isolating affected service instances from the service cluster, and switching to at least one of the backup service instances.

9. The software intrinsic security risk assessment and resilient defense system according to any one of claims 1-8, characterized in that: include: The data acquisition module is used to continuously collect multi-dimensional telemetry data while the target software is running; The dynamic baseline learning module is used to build and update behavioral baselines based on historical normal data; The real-time risk detection and profile building module is used for baseline comparison, anomaly calculation, and dependency risk profile building. The risk transmission analysis and assessment module is used to construct a dependency risk transmission diagram, an execution diagram propagation algorithm, and generate a comprehensive risk assessment report. The resilient response strategy execution module is used to execute tiered defensive response actions based on risk assessment levels. The threat intelligence access module is used to acquire external threat intelligence data.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-8.

Images