Open source license compliance verification method and device, equipment and storage medium

Abstract

The invention provides an open source license compliance verification method and device, equipment and a storage medium, and relates to the technical field of computers. In some embodiments of the disclosure, license identification is performed on an obtained software package to obtain a license name, a license category and a license text corresponding to a license; according to the license category, performing compliance risk pre-verification on the license to obtain a pre-verification result; performing text multi-label classification identification on the license text to obtain a license text label corresponding to the license text; according to a license text label corresponding to the license text, compliance risk content verification is carried out, and a content verification result is obtained; determining a target prediction result according to the pre-verification result and the content verification result; according to the method and the device, the target prediction result is further determined according to the pre-verification result and the content verification result by pre-verifying the compliance risk and verifying the compliance risk content, so that the compliance verification precision of the open source license is improved, and the user experience is improved.

Description

Open source license compliance verification methods, devices, equipment and storage media Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for verifying open source license compliance. Background Technology

[0002] A software license, as a legal permit granted by the copyright holder to a user, stipulates the user's rights, obligations, and prohibitions when using the software. A software license is expressed in the form of a written description, clearly stating the conditions under which the user can freely use, modify, and distribute the software. Against the backdrop of an explosive growth in various software applications, in order to shorten software development cycles, developers inevitably use various third-party open-source code and components, which in turn involve several software licenses. Generally, a software product typically includes a project license and several component licenses.

[0003] Currently, different licenses impose varying degrees of constraints on users' rights and obligations. Based on the strength of these constraints, they are generally categorized as permissive licenses, weak copyleft licenses, and strong copyleft licenses. For a software product with multiple licenses, incompatibility issues may arise due to conflicting license terms, leading to compliance risks for users. Furthermore, license terms are expressed in diverse ways, and software licenses do not impose fixed syntax requirements on the terms. Manually maintaining a thesaurus and defining matching rules is insufficient to cover all possibilities, especially when dealing with complex sentences such as long sentences with multiple modifiers, negative inversions, and double negatives, where the accuracy of clause recognition becomes difficult to guarantee.

[0004] Currently, the accuracy of open-source license compliance verification is low, resulting in a poor user experience. Summary of the Invention

[0005] This disclosure provides an open-source license compliance verification method, apparatus, device, and storage medium to at least address the issues of low accuracy and poor user experience in existing open-source license compliance verification.

[0006] The technical solution disclosed herein is as follows: This disclosure provides an open-source license compliance verification method, comprising: identifying the license of the acquired software package to obtain the license name, license category, and license text corresponding to the license; performing compliance risk pre-verification on the license according to the license category to obtain a pre-verification result; performing text multi-tag classification and recognition on the license text to obtain the license text tag corresponding to the license text; performing compliance risk content verification according to the license text tag corresponding to the license text to obtain a content verification result; and determining a target prediction result based on the pre-verification result and the content verification result.

[0007] Optionally, the step of performing text multi-tag classification and recognition on the license text to obtain the license text tag corresponding to the license text includes: setting a text tag for each license clause category according to the degree of right restriction corresponding to each license clause based on a preset license clause category, thereby obtaining the license text tag corresponding to the license text.

[0008] Optionally, the content verification result includes: a compliance risk matrix, a compliance risk index, and a compliance risk level. The step of verifying compliance risk content based on the license text tags corresponding to the license text to obtain the content verification result includes: generating a license tag matrix based on the license text tags corresponding to the license text; determining the compliance risk matrix and the compliance risk index based on the license tag matrix; and determining the compliance risk level based on the compliance risk index.

[0009] Optionally, generating a license tag matrix based on the license text tags corresponding to the license text includes: generating a license text tag sequence corresponding to the license text based on the license text tags corresponding to the license text; and generating a license tag matrix based on the license text tag sequence corresponding to each license text.

[0010] Optionally, determining the compliance risk matrix and the compliance risk index based on the license label matrix includes: identifying individual compatibility at the license execution clause level based on the license label matrix to obtain the compliance risk matrix; and determining the compliance risk index based on the clause importance weights.

[0011] Optionally, the step of identifying individual compatibility at the license execution clause level based on the license tag matrix to obtain a compliance risk matrix includes: combining any two license text tags in the license text tag sequence and converting them to decimal to obtain a license clause category vector; and generating a compliance risk matrix based on the license clause category vector.

[0012] Optionally, determining the compliance risk level based on the compliance risk index includes: determining the compliance risk level as a first compliance risk when the compliance risk index is greater than or equal to a first threshold and less than a second threshold; determining the compliance risk level as a second compliance risk when the compliance risk index is greater than or equal to the second threshold and less than a third threshold; and determining the compliance risk level as a third compliance risk when the compliance risk index is greater than or equal to the third threshold and less than or equal to a fourth threshold; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold.

[0013] Optionally, determining the target prediction result based on the pre-verification result and the content verification result includes: comparing the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, then the content verification result is used as the target prediction result; if the comparison result shows that the verification results are inconsistent, then review information is sent to the review terminal for manual review based on the review information.

[0014] Optionally, comparing the pre-verification result and the content verification result to obtain a comparison result includes: calculating a consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to a score threshold, then determining that the comparison result is consistent; if the consistency score is less than the score threshold, then determining that the comparison result is inconsistent.

[0015] This embodiment also provides an open-source license compliance verification device, comprising: a first identification module for identifying the license of the acquired software package to obtain the license name, license category, and license text corresponding to the license; a pre-verification module for performing compliance risk pre-verification on the license according to the license category to obtain a pre-verification result; a second identification module for performing text multi-tag classification and identification on the license text to obtain the license text tag corresponding to the license text; a content verification module for performing compliance risk content verification according to the license text tag corresponding to the license text to obtain a content verification result; and a determination module for determining a target prediction result based on the pre-verification result and the content verification result.

[0016] Optionally, when the second recognition module performs text multi-tag classification and recognition on the license text to obtain the license text tag corresponding to the license text, it is used to: set a text tag for each license clause category according to the degree of right restriction corresponding to each license clause, based on the preset license clause categories, to obtain the license text tag corresponding to the license text.

[0017] Optionally, the content verification result includes: a compliance risk matrix, a compliance risk index, and a compliance risk level. When the content verification module performs compliance risk content verification based on the license text tags corresponding to the license text and obtains the content verification result, it is used to: generate a license tag matrix based on the license text tags corresponding to the license text; determine the compliance risk matrix and the compliance risk index based on the license tag matrix; and determine the compliance risk level based on the compliance risk index.

[0018] Optionally, when generating a license tag matrix based on the license text tags corresponding to the license text, the content verification module is configured to: generate a license text tag sequence corresponding to the license text based on the license text tags corresponding to the license text; and generate a license tag matrix based on the license text tag sequence corresponding to each license text.

[0019] Optionally, when determining the compliance risk matrix and the compliance risk index based on the license tag matrix, the content verification module is used to: identify individual compatibility at the license execution clause level based on the license tag matrix to obtain the compliance risk matrix; and determine the compliance risk index based on the importance weight of the clauses.

[0020] Optionally, when the content verification module obtains a compliance risk matrix by identifying single-item compatibility at the license execution clause level based on the license tag matrix, it is used to: combine any two license text tags in the license text tag sequence and convert them to decimal to obtain a license clause category vector; and generate a compliance risk matrix based on the license clause category vector.

[0021] Optionally, when determining the compliance risk level based on the compliance risk index, the content verification module is configured to: determine the compliance risk level as a first compliance risk if the compliance risk index is greater than or equal to a first threshold and less than a second threshold; determine the compliance risk level as a second compliance risk if the compliance risk index is greater than or equal to the second threshold and less than a third threshold; and determine the compliance risk level as a third compliance risk if the compliance risk index is greater than or equal to the third threshold and less than or equal to a fourth threshold; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold.

[0022] Optionally, when determining the target prediction result based on the pre-verification result and the content verification result, the determining module is configured to: compare the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, then the content verification result is used as the target prediction result; if the comparison result shows that the verification results are inconsistent, then a review message is sent to the review terminal for manual review based on the review message.

[0023] Optionally, the determining module obtains a comparison result by comparing the pre-verification result and the content verification result, including: calculating a consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to a score threshold, then determining that the comparison result is consistent; if the consistency score is less than the score threshold, then determining that the comparison result is inconsistent.

[0024] This disclosure also provides an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the steps of the methods described above.

[0025] This disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0026] This disclosure also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described above.

[0027] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects: In some embodiments of this disclosure, the obtained software package is identified by license recognition to obtain the license name, license category, and license text corresponding to the license; based on the license category, compliance risk pre-verification is performed on the license to obtain pre-verification results; text multi-tag classification and recognition are performed on the license text to obtain the license text tags corresponding to the license text; based on the license text tags corresponding to the license text, compliance risk content verification is performed to obtain content verification results; based on the pre-verification results and content verification results, the target prediction result is determined; this disclosure improves the accuracy of open source license compliance verification and enhances user experience by performing compliance risk pre-verification and compliance risk content verification, and further determining the target prediction result based on the pre-verification results and content verification results.

[0028] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0030] Figure 1 is a flowchart illustrating an open-source license compliance verification method provided by an exemplary embodiment of this disclosure; Figure 2 is a framework diagram illustrating an open-source license compliance verification system provided by an exemplary embodiment of this disclosure; Figure 3 is a detailed flowchart illustrating an open-source license compliance verification method provided by an exemplary embodiment of this disclosure; Figure 4 is a structural schematic diagram illustrating an open-source license compliance verification device provided by an exemplary embodiment of this disclosure; Figure 5 is a structural schematic diagram illustrating an electronic device provided by an exemplary embodiment of this disclosure. Detailed Implementation

[0031] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0032] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure.

[0033] It should be noted that the user information involved in this disclosure includes, but is not limited to, user device information and user personal information; the collection, storage, use, processing, transmission, provision and disclosure of user information in this disclosure all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0034] To address the aforementioned technical issues, in some embodiments of this disclosure, the obtained software package is licensed to obtain the license name, license category, and license text corresponding to the license; based on the license category, compliance risk pre-verification is performed on the license to obtain pre-verification results; the license text is classified and identified using text multi-tags to obtain the license text tags corresponding to the license text; based on the license text tags corresponding to the license text, compliance risk content verification is performed to obtain content verification results; based on the pre-verification results and content verification results, the target prediction result is determined; this disclosure improves the accuracy of open-source license compliance verification and enhances user experience by performing compliance risk pre-verification and compliance risk content verification, and further determining the target prediction result based on the pre-verification results and content verification results.

[0035] The technical solutions provided by the embodiments of this disclosure are described in detail below with reference to the accompanying drawings.

[0036] Figure 1 is a flowchart illustrating an open-source license compliance verification method provided by an exemplary embodiment of this disclosure. As shown in Figure 1, the method includes: S101: performing license identification on the obtained software package to obtain the license name, license category, and license text corresponding to the license; S102: performing compliance risk pre-verification on the license according to the license category to obtain the pre-verification result; S103: performing text multi-label classification and recognition on the license text to obtain the license text label corresponding to the license text; S104: performing compliance risk content verification on the license text label corresponding to the license text to obtain the content verification result; S105: determining the target prediction result based on the pre-verification result and the content verification result.

[0037] In this embodiment, the subject executing the above method is a terminal device or a server.

[0038] The terminal device includes, but is not limited to, mobile stations (MS), mobile terminals, mobile phones, handsets, and portable equipment. This terminal device can communicate with one or more core networks via a radio access network (RAN). For example, the terminal device can be a mobile phone (or "cellular" phone), a computer with wireless communication capabilities, a computer with wireless transceiver capabilities, a virtual reality (VR) terminal device, an AR terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The operating systems installed on the terminal device include, but are not limited to, iOS, Android, Windows, Linux, and Mac OS. In different networks, terminals may be called by different names, such as: user equipment, mobile station, user unit, station, cellular phone, personal digital assistant, wireless modem, wireless communication device, handheld device, laptop, cordless phone, wireless local loop station, television, etc. For ease of description, this embodiment will simply refer to it as terminal device.

[0039] In this embodiment, the implementation form of the server is not limited. For example, the server can be a conventional server, a cloud server, a cloud host, a virtual center, or other server devices. The server mainly consists of a processor, hard disk, memory, system bus, and other common computer architecture types.

[0040] In this embodiment, the obtained software package is licensed to obtain the license name, license category, and license text. Based on the license category, compliance risk pre-verification is performed on the license to obtain a pre-verification result. The license text is then classified using multi-tag classification to obtain the corresponding license text tags. Based on the license text tags, compliance risk content verification is performed to obtain a content verification result. Based on the pre-verification result and the content verification result, a target prediction result is determined. This disclosure improves the accuracy of open-source license compliance verification and enhances user experience by performing compliance risk pre-verification and compliance risk content verification, and further determining the target prediction result based on the pre-verification result and content verification result.

[0041] It should be noted that this publicly available software product is used in software supply chain security governance to automatically identify, perform clause-level semantic analysis, and quantify compliance risks of open-source licenses for software projects and their dependent components. This publicly available software product can run independently or be embedded into enterprise CI / CD pipelines as APIs, plugins, cloud services, etc., to achieve a "development is compliance" shift-left verification model; it is also suitable for enterprise-level compliance audit platforms for centralized scanning and management of large-scale software assets.

[0042] Figure 2 is a framework diagram of an open-source license compliance verification system provided by an exemplary embodiment of this disclosure. The system includes: a license identification module, a license pre-verification module, a license data intelligent extraction module, a license content verification module, and a secondary verification module. First, the license identification module identifies the license name (labeled as an authorized license or component license) and license text in the input software package, and inputs them into the license pre-verification module and the license data intelligent extraction module, respectively. Then, the license pre-verification module pre-verifies compliance risks based on license category and outputs the results to the secondary verification module. The license data intelligent extraction module performs multi-label classification of the license text, identifies license text labels, and outputs them to the license content verification module. The license content verification module comprehensively analyzes all license text labels of the input software to form a compliance risk matrix and compliance risk index, which is then output to the secondary verification module. The secondary verification module compares the results of the pre-verification module and the content verification module to analyze whether there are other unexpected risks and outputs the final result.

[0043] In some embodiments of this disclosure, the acquired software package is licensed to obtain the license name, license category, and license text corresponding to the license. A software typically contains one main license and several component licenses. To facilitate subsequent analysis, the license recognition module identifies and extracts the names and text content of all main licenses and component licenses in the software under test, and inputs them into the intelligent license data extraction module and the license pre-verification module, respectively.

[0044] Table 1 below shows the data input to the license pre-verification module. The input data can come from source file header comments (such as SPDX-Identifier), project configuration files (such as package.json, pom.xml), SBOM files (such as SPDX, CycloneDX), and text fragments in binary files. This module ensures that the system can cover license claims from different sources, thereby achieving full coverage recognition of software licenses.

[0045]

[0046] Table 1 shows the compliance risk pre-verification results of licenses based on license categories in some embodiments of this disclosure. Licenses are categorized into three types based on a pre-built database: permissive licenses, weak copyleft licenses (weak copyright co-authorship licenses), and strong copyleft licenses (strong copyright co-authorship licenses). It should be noted that license types not included in the database are labeled as permissive licenses, and the category relationship between the license and component licenses is quickly determined. If a significant conflict is found, a preliminary risk warning is output. This module enables rapid risk filtering at low cost and is suitable for large-scale dependency scenarios. The pre-verification module consists of a license name recognition component and a pre-built database.

[0047] Its workflow is designed as follows: 1) Receive the data in Table 1 from the license identification module. Table 1 has marked the authorized license and component license. Retrieve the license categories from the preset database and supplement Table 1.

[0048] The pre-built database stores known license names (including more than 600 licenses and their types included in SPDX), and classifies them into three categories according to the strength of their restrictions: {strong copyleft, weak copyleft, and permissive}.

[0049] ① A strong copyleft license requires that any derivative works be distributed under the same license used by the original work; ② A weak copyleft license allows derivative works to be distributed under other licenses, but the license of the weak copyleft license code used in the derivative works must not be changed; ③ A permissive license allows any code in the work to be distributed under other licenses.

[0050] Based on the transitivity and unidirectionality of license restrictions, compatibility only extends from "loosely restricted licenses" to "strictly restricted licenses." The compatibility of different license types can be expressed as: strong copyleft license <— weak copyleft license <— loosely restricted license.

[0051] That is, if the software's license type is a permissive license, then it cannot be compatible with its component licenses which are strong copyleft licenses; if the license type is a strong copyleft license, then its compatible component licenses are weak copyleft licenses or permissive licenses.

[0052]

[0053] Table 22) Identify compliance risks according to license category and output the names of conflicting licenses to form a pre-verification result set Rpre.

[0054] For example: A software has five license types XYZMN, where Y is the authorized license and its license type is weak copyleft. After the license pre-verification module identifies whether each license is an authorized license and its license type in the above steps, it outputs Z and M, which are incompatible with the authorized license Y.

[0055]

[0056] Table 3 shows the intelligent license data extraction module, which preprocesses the license text (including word segmentation, stop word removal, semantic dependency analysis, and syntactic tree parsing) and transforms complex clause text into a license tag matrix (SL). This ensures that even with licenses not yet included or newly appearing, key constraints can be identified through clause semantic analysis.

[0057] The workflow is designed as follows: 1) Explanation: Since SPDX already contains over 600 types of license data, and there are also several licenses with incomplete content, those newly appearing with software product development, and those not officially included, manual preprocessing of the data, such as word segmentation and annotation, is difficult to cover all licenses and would consume a significant amount of manpower. Therefore, to adapt to the constantly emerging new types of licenses and reduce manual labor, the license data intelligent extraction module uses a multi-label text classification method to adaptively identify the increasing number of unknown license texts using only the existing 600+ licenses and a relatively small training set. The text analysis method can be any algorithm capable of multi-label text classification, such as rule-based and machine learning combinations, knowledge graph-based semantic recognition, or multi-label classification based on deep language models (e.g., Transformer).

[0058] In some embodiments of this disclosure, the license text is classified and identified using multiple text tags to obtain the license text tags corresponding to the license text. One possible approach is to set text tags for each license clause category according to the degree of restriction of rights corresponding to each license clause, based on a preset license clause category, to obtain the license text tags corresponding to the license text.

[0059] 2) A multi-label text classification algorithm is used to classify single license texts according to the following multi-label text classification method: Based on common license clause categories, two labels are set for each license clause category according to its degree of restriction of rights, for a total of 13 clause categories and 26 selectable labels (the types and number of labels are not limited, as long as they can cover common clauses): Commercial, Distribution, Modification, Patent use, Private use, Disclose source, License and copyright notice, Network use is distribution, Same license, State changes, Liability, Trademark use, and Warranty.

[0060]

[0061] Table 4 shows that in some embodiments of this disclosure, the content verification results include: a compliance risk matrix, a compliance risk index, and a compliance risk level. Compliance risk content verification is performed based on the license text tags corresponding to the license text to obtain the content verification results. One possible approach is to generate a license tag matrix based on the license text tags corresponding to the license text; determine the compliance risk matrix and compliance risk index based on the license tag matrix; and determine the compliance risk level based on the compliance risk index.

[0062] In the above embodiments, a license tag matrix is ​​generated based on the license text tags corresponding to the license texts. One possible approach is to generate a sequence of license text tags corresponding to each license text, and then generate a license tag matrix based on the sequence of license text tags corresponding to each license text.

[0063] 3) After text multi-label classification and recognition, a license label sequence is output for each license text in the software under test. And form the license tag matrix SL of the software under test: Where j represents the j-th license of the software being tested, defined as j=1 when... Indicates a software license; It is a 1×26 matrix composed of 0s and 1s, where 26 is the number of tags. If the identification result of the corresponding tag position is 1, it means that the license text contains the claim content corresponding to this tag.

[0064]

[0065] Where m is the total number of licenses, and j=1 represents the software's license.

[0066] In this embodiment, the license content verification module, based on the license tag matrix SL output by the license data intelligent extraction module, identifies one-way compatibility at the clause level between the authorized license and the component license, and outputs a compliance risk matrix (CPR). It then calculates the compliance risk index (CRI) by combining the importance weights of the clauses, and classifies the results into low, medium, and high risk levels. The output not only includes numerical results but may also include specific conflict clause information to enhance the interpretability of the compliance results.

[0067] The specific workflow design is as follows: Due to the one-way compatibility of licenses, if the licensed license has more lenient claims, the component license is allowed to have stricter or equivalent claims than the licensed license; if the licensed license has stricter claims, it is not compatible with component licenses that have more lenient claims.

[0068] Therefore, the 26 tags are paired up to represent two states of restriction of rights under the same license terms. Table 4 shows the degree of restriction of rights for each tag, and each group of tags is arranged in the order of "lenient" and "strict". If a legal provision does not have any label identified, it means that the license does not bind that legal provision and can be considered "lenient".

[0069] In some embodiments of this disclosure, a compliance risk matrix and a compliance risk index are determined based on a license label matrix. The compliance risk matrix is ​​obtained by identifying individual compatibility at the license enforcement clause level based on the license label matrix; the compliance risk index is then determined based on the clause importance weights.

[0070] Assuming a license Component license Component license Component license Then, it will be judged according to the one-way compatibility of the license. and compatible( (1,0) is compatible with (0,1) and Incompatible ( (0,1) is incompatible with (1,0) and compatible( (1,0) is compatible with (0,0)).

[0071] In the above embodiments, a compliance risk matrix is ​​obtained by identifying individual compatibility at the license execution clause level based on the license tag matrix. One possible approach is to combine any two license text tags from the license text tag sequence and convert them to decimal to obtain a license clause category vector; the compliance risk matrix is ​​then generated based on the license clause category vector.

[0072] Therefore, define the license term category vector for the j-th license in the software. (License terms category), tag it Convert the elements in the given set to decimal by combining them in pairs:

[0073] The license terms category matrix LT:

[0074] by Based on the baseline, each row is divided by element and The approach involves identifying compliance risks based on one-way compatibility and generating a Compliance Risk (CPR) matrix.

[0075]

[0076] in, This represents the risk value of license j under the i-th license terms category. This indicates that license j is compatible with the authorized license under the i-th license terms category and there is no compliance risk. This indicates incompatibility. The output is not only a numerical matrix, but also information on specific conflicting terms and license names, making it easier for users to quickly locate the source of risk. This result is output as a set Rcontent, defined as the content verification result.

[0077] In some embodiments of this disclosure, a compliance risk index is determined based on the weighting of the importance of each clause. Specifically, to measure the severity of compliance risk, a Compliance Risk Index (CRI) is defined, taking into account the frequency of compliance risk occurrence under each license clause category and the weighting of the importance of each legal clause:

[0078] in, This refers to the weighting of the terms' importance; this weighting can be defined according to risk appetite. .

[0079] In some embodiments of this disclosure, a compliance risk level is determined based on a compliance risk index. If the compliance risk index is greater than or equal to a first threshold and less than a second threshold, the compliance risk level is determined to be a first compliance risk; if the compliance risk index is greater than or equal to the second threshold and less than a third threshold, the compliance risk level is determined to be a second compliance risk; if the compliance risk index is greater than or equal to the third threshold and less than or equal to a fourth threshold, the compliance risk level is determined to be a third compliance risk. Wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold. The first compliance risk is considered low compliance risk, the second compliance risk is considered medium compliance risk, and the third compliance risk is considered high compliance risk.

[0080] For example, Low compliance risk; To mitigate compliance risks; For high compliance risks, corresponding risk mitigation measures should be taken based on different risk levels. The calculation of CRI can further incorporate a time decay factor (considering the impact of license version updates), a usage scenario weighting factor (such as internal use, external distribution, SaaS scenarios), and output prompts for clause conflicts to enhance the interpretability of compliance results.

[0081] In some embodiments of this disclosure, the target prediction result is determined based on the pre-verification result and the content verification result. One possible approach is to compare the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, the content verification result is used as the target prediction result; if the comparison result shows that the verification results are inconsistent, verification information is sent to the verification terminal for manual verification based on the verification information. The secondary verification module compares the pre-verification result Rpre and the content verification result Rcontent. If the results are consistent, a conclusion is directly output; if inconsistent, manual verification or further analysis is triggered. The comparison method can combine fuzzy matching, semantic similarity calculation, and cross-validation using external databases (such as SPDX, OSADL, or an internal enterprise compliance database), and output a confidence index. When the confidence level is insufficient, the system prompts for manual confirmation to reduce false negatives and false positives.

[0082] In the above embodiments, a comparison result is obtained by comparing the pre-verification result and the content verification result. One possible approach is to calculate the consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to a score threshold, the comparison result is determined to be consistent; if the consistency score is less than the score threshold, the comparison result is determined to be inconsistent.

[0083] To improve accuracy, a consistency scoring function is constructed based on the pre-validation result Rpre and the content validation result Rcontent:

[0084] Where Sim(Rpre, Rcontent) represents the similarity between the pre-verification result and the content verification result, with a value range of [0,1]; Cext represents the consistency of the result based on cross-validation using an external database. Validation methods may include fuzzy matching, semantic similarity calculation, or cross-validation using external databases (such as SPDX, OSADL, or an internal enterprise compliance library); α and β are weighting coefficients, with α+β=1. Let the scoring threshold S be θ. If S≥θ, the verification result is considered consistent, and the conclusion is output directly; if S<θ, the verification result is considered inconsistent, triggering manual review or further analysis.

[0085] It should be noted that the license pre-verification module uses prior knowledge from a pre-built database to determine whether there are compatibility risks between licenses. Since the pre-built database only distinguishes licenses by type, the accuracy of license risk identification is likely to be low. The license content verification module, on the other hand, uses the output of the intelligent license data extraction module to identify compliance risks for each type of legal clause, exhibiting higher accuracy. However, it should be considered that if the outputs of the license pre-verification module and the license content verification module are inconsistent, it may be due to unintended modifications made to the license content by the developers.

[0086] Figure 3 is a detailed flowchart of an open-source license compliance verification method provided by an exemplary embodiment of this disclosure. As shown in Figure 3, the method includes the following steps: Step 1: The software package input license identification module extracts information; Step 2: The license pre-verification module performs rapid risk filtering; Step 3: The license data intelligent extraction module generates a clause tag matrix SL; Step 4: The license content verification module performs clause compatibility judgment and outputs CPR and CRI; Step 5: The secondary verification module integrates the results, and if the results are inconsistent, a review is triggered; Step 6: The compliance report is output, including a license list, compatibility conclusion, risk index, conflict clause pairs, and handling suggestions.

[0087] Referring to Figure 3, take the following example: MIT license; GPLv3, Apache 2.0, and unknown license X as components.

[0088] Recognition results: Extracted texts for MIT, GPLv3, Apache 2.0, and an unknown license X.

[0089] Pre-validation results: The MIT and GPLv3 categories differ significantly, initially suggesting a conflict.

[0090] Intelligent extraction results: The system identified that the unknown license X contains clauses such as "commercial use prohibited" and "source code disclosure required".

[0091] Content verification results: MIT conflicts with GPLv3 in terms of distribution terms; MIT conflicts with License X in terms of commercial terms; MIT is compatible with Apache 2.0. The CPR matrix shows two conflicts, with CRI=0.82, indicating a high risk.

[0092] Secondary verification result: The verification result is consistent with the pre-verification, confirming the validity of the conflicting clause.

[0093] Output report: The final report indicates that the overall risk of the project is "high" and recommends replacing the GPLv3 component or adjusting the licensing policy.

[0094] Figure 4 is a schematic diagram of the structure of an open source license compliance verification device 40 provided in an exemplary embodiment of this disclosure. As shown in Figure 4, the open source license compliance verification device 40 includes: a first identification module 41, a pre-verification module 42, a second identification module 43, a content verification module 44, and a determination module 45.

[0095] The system comprises the following modules: a first identification module 41, which identifies the license of the acquired software package to obtain the license name, license category, and license text; a pre-verification module 42, which performs compliance risk pre-verification on the license based on the license category to obtain the pre-verification result; a second identification module 43, which performs text multi-tag classification and identification on the license text to obtain the license text tag corresponding to the license text; a content verification module 44, which performs compliance risk content verification based on the license text tag corresponding to the license text to obtain the content verification result; and a determination module 45, which determines the target prediction result based on the pre-verification result and the content verification result.

[0096] Optionally, when the second recognition module 43 performs text multi-label classification and recognition on the license text to obtain the license text label corresponding to the license text, it is used to: set a text label for each license clause category according to the degree of right restriction corresponding to each license clause based on the preset license clause category, so as to obtain the license text label corresponding to the license text.

[0097] Optionally, the content verification results include: a compliance risk matrix, a compliance risk index, and a compliance risk level. When the content verification module 44 performs compliance risk content verification based on the license text tags corresponding to the license text and obtains the content verification results, it is used to: generate a license tag matrix based on the license text tags corresponding to the license text; determine the compliance risk matrix and compliance risk index based on the license tag matrix; and determine the compliance risk level based on the compliance risk index.

[0098] Optionally, when generating the license tag matrix based on the license text tags corresponding to the license text, the content verification module 44 is used to: generate a sequence of license text tags corresponding to the license text based on the license text tags corresponding to the license text; and generate a license tag matrix based on the sequence of license text tags corresponding to each license text.

[0099] Optionally, when determining the compliance risk matrix and compliance risk index based on the license tag matrix, the content verification module 44 is used to: identify individual compatibility at the license execution clause level based on the license tag matrix to obtain the compliance risk matrix; and determine the compliance risk index based on the importance weight of the clauses.

[0100] Optionally, when the content verification module 44 obtains a compliance risk matrix by identifying individual compatibility at the license execution clause level based on the license tag matrix, it is used to: combine any two license text tags in the license text tag sequence and convert them to decimal to obtain a license clause category vector; and generate a compliance risk matrix based on the license clause category vector.

[0101] Optionally, when determining the compliance risk level based on the compliance risk index, the content verification module 44 is configured to: determine the compliance risk level as first compliance risk if the compliance risk index is greater than or equal to a first threshold and less than a second threshold; determine the compliance risk level as second compliance risk if the compliance risk index is greater than or equal to a second threshold and less than a third threshold; and determine the compliance risk level as third compliance risk if the compliance risk index is greater than or equal to a third threshold and less than or equal to a fourth threshold; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold.

[0102] Optionally, when determining the target prediction result based on the pre-verification result and the content verification result, the determining module 45 is used to: compare the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, then the content verification result is used as the target prediction result; if the comparison result shows that the verification results are inconsistent, then the verification information is sent to the verification terminal for manual verification based on the verification information.

[0103] Optionally, the determination module 45 obtains a comparison result by comparing the pre-verification result and the content verification result, including: calculating the consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to the score threshold, then the comparison result is determined to be consistent; if the consistency score is less than the score threshold, then the comparison result is determined to be inconsistent.

[0104] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0105] Figure 5 is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present disclosure. As shown in Figure 5, the electronic device includes a memory 51 and a processor 52. Additionally, the electronic device also includes a power supply component 53 and a communication component 54.

[0106] Memory 51 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device.

[0107] The memory 51 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0108] Communication component 54 is used for data transmission with other devices.

[0109] The processor 52 can execute computer instructions stored in the memory 51 to: identify the license of the acquired software package to obtain the license name, license category and license text corresponding to the license; perform compliance risk pre-verification on the license according to the license category to obtain the pre-verification result; perform text multi-label classification and recognition on the license text to obtain the license text label corresponding to the license text; perform compliance risk content verification according to the license text label corresponding to the license text to obtain the content verification result; and determine the target prediction result based on the pre-verification result and the content verification result.

[0110] Accordingly, this disclosure also provides a computer-readable storage medium storing a computer program. When the computer-readable storage medium stores a computer program, and the computer program is executed by one or more processors, the one or more processors cause the one or more processors to perform the steps in the method embodiment of FIG1.

[0111] Accordingly, this disclosure also provides a computer program product, which includes a computer program / instructions, and the computer program / instructions are executed by a processor to perform the steps in the method embodiment of FIG1.

[0112] The communication component in Figure 5 above is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component also includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA) technology, Ultra-Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0113] The power supply component in Figure 5 above provides power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0114] The aforementioned electronic devices also include a display screen and audio components.

[0115] The display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions, but also the duration and pressure associated with the touch or swipe operation.

[0116] An audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals may be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0117] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0121] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0123] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0125] The above are merely specific embodiments of this disclosure, enabling those skilled in the art to understand or implement this disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to these embodiments, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for verifying open-source license compliance, characterized in that, include: The obtained software packages are licensed to obtain the license name, license category, and license text. Based on the license category, a compliance risk pre-verification is performed on the license to obtain the pre-verification results; The license text is classified and identified using a multi-tag method to obtain the license text tag corresponding to the license text; based on the license text tag corresponding to the license text, compliance risk content verification is performed to obtain the content verification result; Based on the pre-verification results and the content verification results, the target prediction result is determined.

2. The method according to claim 1, characterized in that, The step of performing text multi-tag classification and recognition on the license text to obtain the license text tag corresponding to the license text includes: setting a text tag for each license clause category according to the degree of right restriction corresponding to each license clause, based on a preset license clause category, to obtain the license text tag corresponding to the license text.

3. The method according to claim 1, characterized in that, The content verification results include: a compliance risk matrix, a compliance risk index, and a compliance risk level. The process of verifying compliance risk content based on the license text tags corresponding to the license text to obtain the content verification results includes: generating a license tag matrix based on the license text tags corresponding to the license text; determining the compliance risk matrix and the compliance risk index based on the license tag matrix; and determining the compliance risk level based on the compliance risk index.

4. The method according to claim 3, characterized in that, The step of generating a license tag matrix based on the license text tags corresponding to the license text includes: generating a license text tag sequence corresponding to the license text based on the license text tags corresponding to the license text; and generating a license tag matrix based on the license text tag sequence corresponding to each license text.

5. The method according to claim 3, characterized in that, The step of determining the compliance risk matrix and the compliance risk index based on the license label matrix includes: identifying individual compatibility at the license execution clause level based on the license label matrix to obtain the compliance risk matrix; and determining the compliance risk index based on the importance weight of the clauses.

6. The method according to claim 5, characterized in that, The step of identifying individual compatibility at the license execution clause level based on the license tag matrix to obtain a compliance risk matrix includes: combining any two license text tags in the license text tag sequence and converting them to decimal to obtain a license clause category vector; and generating a compliance risk matrix based on the license clause category vector.

7. The method according to claim 3, characterized in that, Determining the compliance risk level based on the compliance risk index includes: determining the compliance risk level as a first compliance risk when the compliance risk index is greater than or equal to a first threshold and less than a second threshold; determining the compliance risk level as a second compliance risk when the compliance risk index is greater than or equal to the second threshold and less than a third threshold; and determining the compliance risk level as a third compliance risk when the compliance risk index is greater than or equal to the third threshold and less than or equal to a fourth threshold; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold.

8. The method according to claim 1, characterized in that, The step of determining the target prediction result based on the pre-verification result and the content verification result includes: comparing the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, then the content verification result is taken as the target prediction result; if the comparison result shows that the verification results are inconsistent, then review information is sent to the review terminal for manual review based on the review information.

9. The method according to claim 8, characterized in that, The step of comparing the pre-verification result and the content verification result to obtain a comparison result includes: calculating the consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to a score threshold, then the comparison result is determined to be consistent; if the consistency score is less than the score threshold, then the comparison result is determined to be inconsistent.

10. An open-source license compliance verification device, characterized in that, include: The first identification module is used to identify the license of the acquired software package and obtain the license name, license category and license text corresponding to the license. The pre-verification module is used to perform compliance risk pre-verification on the license according to the license category and obtain the pre-verification result; The second identification module is used to perform text multi-tag classification and identification on the license text to obtain the license text tag corresponding to the license text; the content verification module is used to perform compliance risk content verification based on the license text tag corresponding to the license text to obtain the content verification result. The determination module is used to determine the target prediction result based on the pre-verification result and the content verification result.

11. The open-source license compliance verification device according to claim 10, characterized in that, When the second recognition module performs text multi-tag classification and recognition on the license text to obtain the license text tag corresponding to the license text, it is used to: set a text tag for each of the preset license clause categories according to the degree of right restriction corresponding to each license clause, so as to obtain the license text tag corresponding to the license text.

12. The open-source license compliance verification device according to claim 10, characterized in that, The content verification results include: a compliance risk matrix, a compliance risk index, and a compliance risk level. When the content verification module performs compliance risk content verification based on the license text tags corresponding to the license text and obtains the content verification results, it is used to: generate a license tag matrix based on the license text tags corresponding to the license text; determine the compliance risk matrix and the compliance risk index based on the license tag matrix; and determine the compliance risk level based on the compliance risk index.

13. The open-source license compliance verification device according to claim 12, characterized in that, When generating a license tag matrix based on the license text tags corresponding to the license text, the content verification module is used to: generate a license text tag sequence corresponding to the license text based on the license text tags corresponding to the license text; and generate a license tag matrix based on the license text tag sequence corresponding to each license text.

14. The open-source license compliance verification device according to claim 12, characterized in that, When determining the compliance risk matrix and the compliance risk index based on the license tag matrix, the content verification module is used to: identify individual compatibility at the license execution clause level based on the license tag matrix to obtain the compliance risk matrix; The compliance risk index is determined based on the weighting of the importance of each clause.

15. The open-source license compliance verification device according to claim 14, characterized in that, When the content verification module identifies single-item compatibility at the license execution clause level based on the license tag matrix to obtain a compliance risk matrix, it is used to: combine any two license text tags in the license text tag sequence and convert them to decimal to obtain a license clause category vector; and generate a compliance risk matrix based on the license clause category vector.

16. The open-source license compliance verification device according to claim 12, characterized in that, When determining the compliance risk level based on the compliance risk index, the content verification module is configured to: determine the compliance risk level as the first compliance risk if the compliance risk index is greater than or equal to a first threshold and the compliance risk index is less than a second threshold. If the compliance risk index is greater than or equal to the second threshold and less than the third threshold, the compliance risk level is determined to be the second compliance risk; if the compliance risk index is greater than or equal to the third threshold and less than or equal to the fourth threshold, the compliance risk level is determined to be the third compliance risk; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, and the third threshold is less than the fourth threshold.

17. The open-source license compliance verification device according to claim 10, characterized in that, When determining the target prediction result based on the pre-verification result and the content verification result, the determining module is configured to: compare the pre-verification result and the content verification result to obtain a comparison result; if the comparison result shows that the verification results are consistent, then the content verification result is used as the target prediction result; If the comparison results show a discrepancy between the verification results and the actual results, a verification message is sent to the verification terminal for manual verification based on the verification message.

18. The open-source license compliance verification device according to claim 17, characterized in that, The determining module compares the pre-verification result and the content verification result to obtain a comparison result, including: calculating the consistency score between the pre-verification result and the content verification result; if the consistency score is greater than or equal to a score threshold, then the comparison result is determined to be consistent; if the consistency score is less than the score threshold, then the comparison result is determined to be inconsistent.

19. An electronic device, characterized in that, include: processor; A memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the steps of the method as described in any one of claims 1-9.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-9.

21. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-9.

Images