Software supply chain risk identification method and system and computer readable storage medium

Abstract

The invention relates to a software supply chain risk identification method and system and a computer readable storage medium. Component data in a software supply chain are collected; performing feature extraction on the component data to respectively form a graph structure feature, a time sequence feature and a text semantic feature; outputting a first score through a graph attention network fusing a multi-head attention mechanism and a time decay factor; generating behavior embedding by splicing the time sequence embedding and the structure embedding, and performing comparative learning on behaviors corresponding to the behavior embedding to generate a second score; performing coding, classification and conflict rule reasoning on the license text to obtain a reasoning result, and combining a conflict probability output by the graph neural network to generate a third score; performing weighted fusion on the first score, the second score and the third score to obtain a comprehensive score; dividing risks according to the comprehensive score; the method has the advantages of being comprehensive in detection, high in accuracy, capable of supporting privacy protection, high in interpretability, capable of being integrated in the CI / CD process and the like.

Description

Technical Field

[0001] This invention belongs to the field of information security and software supply chain management technology, specifically relating to a software supply chain risk identification method, system, and computer-readable storage medium based on multi-dimensional algorithms, which dynamically identifies and assesses potential risks in the software supply chain through intelligent algorithms. Background Technology

[0002] With the increasing complexity of software development models, especially the widespread use of open-source components, third-party libraries, and cloud services, the software supply chain faces increasingly severe security and compliance risks. For example, issues such as malicious code injection, dependency library tampering, license conflicts, and vulnerability propagation occur frequently, posing significant security threats and legal risks to enterprises.

[0003] While some existing systems scan and inspect components in the software supply chain, they generally suffer from the following problems: Single detection dimension: Most systems rely solely on static scanning or vulnerability database matching, lacking a comprehensive evaluation of multiple dimensions such as behavioral characteristics, dependency relationships, and source credibility; Outdated risk assessment mechanisms: lacking dynamic assessment capabilities and unable to adapt to the rapidly changing supply chain environment; High false alarm rate: Traditional rule matching mechanisms are prone to generating a large number of false alarms, which affects detection efficiency; Insufficient algorithmic intelligence: The lack of introduction of machine learning or deep learning makes it difficult to learn risk patterns from historical data; Therefore, there is an urgent need in this field to achieve intelligent, dynamic, and multi-dimensional risk identification and assessment of components in the software supply chain. Summary of the Invention

[0004] Based on the aforementioned shortcomings and deficiencies in the prior art, one of the objectives of this invention is to at least solve one or more of the aforementioned problems in the prior art. In other words, one of the objectives of this invention is to provide a software supply chain risk identification method, system, and computer-readable storage medium that meets one or more of the aforementioned requirements.

[0005] To achieve the above-mentioned objectives, the present invention adopts the following technical solution: A method for identifying risks in the software supply chain includes the following steps: S1. Collect component data from the software supply chain; S2. Extract features from the component data to form graph structure features, time sequence features, and text semantic features respectively; S3. Based on the fusion of graph structure features, temporal sequence features and text semantic features, a relation graph to be identified is generated and input into a graph attention network that integrates multi-head attention mechanism and time decay factor. The risk score is output as the first score. Temporal embeddings and structural embeddings are generated based on temporal sequence features and graph structure features, respectively. Temporal embeddings and structural embeddings are concatenated to generate behavioral embeddings. The behaviors corresponding to the behavioral embeddings are compared and learned to generate a second score. The license category is determined based on the license text in the text semantic features, and the corresponding conflict rule base is matched according to the license category to perform rule reasoning to obtain the conflict reasoning result; the conflict probability is generated based on the license knowledge graph in the component data; and a third score is generated based on the conflict reasoning result and the conflict probability. S4. Weight and merge the first, second, and third scores to obtain the comprehensive score; S5. Risk levels are determined based on the overall score.

[0006] As a preferred embodiment, the component data includes component name, version number, dependency graph, behavior log, license text, and vulnerability information.

[0007] As a preferred embodiment, in the graph attention network that integrates multi-head attention mechanism and time decay factor, the components serve as nodes in the graph structure; If component j updates earlier than component i, a time decay factor is introduced to update the attention coefficient: ; in, The attenuation coefficient is... , For the update timestamps of components i and j, Let be the attention coefficient between the node corresponding to component i and the node corresponding to component j.

[0008] As a preferred embodiment, in step S3, the temporal sequence features are input into the Transformer encoder, and the temporal embedding is output. Input graph structure features into a graph convolutional network and output structure embeddings; The temporal embedding and the structural embedding are concatenated and then input into the fully connected layer, and the behavioral embedding is output. The behavior embedding is compared with the behavior, and the distance between it and the center of the normal row is calculated. It is then determined whether the distance is greater than the similarity value corresponding to the maximum positive sample and the minimum negative sample. If so, the distance is output as the second score; otherwise, the output second score is zero.

[0009] As a preferred embodiment, in step S3, the license text in the semantic features of the text is input into the BERT model for encoding and license type classification, and the license category is output; the corresponding conflict rule base is matched according to the license category to perform rule reasoning, and the conflict reasoning result is obtained; wherein, the conflict reasoning result is either conflicting or not conflicting; Input the license knowledge graph in the dependency graph into the graph neural network, and output the conflict probability; If both the conflict inference result and the graph neural network determine that there is a conflict, the conflict probability will be used as the third score output; if only the graph neural network determines that there is a conflict, the product of the conflict probability and the preset weight will be used as the third score output.

[0010] As a preferred approach, the contrastive learning uses normalized temperature-scaled cross-entropy loss as the loss function.

[0011] As a preferred option, the overall score is: ; in, It received the highest rating. As the second-highest score, It received the third highest rating. , , These are the corresponding weight coefficients. .

[0012] As a preferred embodiment, the risk level classification based on the comprehensive score includes: If the overall score is greater than 0.8, the risk level is classified as high risk; If 0.5 ≤ overall score ≤ 0.8, the risk level is classified as medium risk. If the overall score is less than 0.5, the risk level is classified as low risk.

[0013] As a preferred approach, software supply chain risk identification methods also include: pushing alert messages based on risk levels; If the risk level is high, the warning message will be "It is recommended not to use it"; If the risk level is medium risk, the alert message will suggest review and replacement; If the risk level is low, the alert message is acceptable.

[0014] The present invention also provides a software supply chain risk identification system, which applies the software supply chain risk identification method as described in any of the preceding solutions, wherein the software supply chain risk identification system includes: The data acquisition module is used to collect component data in the software supply chain; The feature extraction module is used to extract features from the component data to form graph structure features, time sequence features, and text semantic features, respectively. The multi-dimensional risk control algorithm module is used to generate a relation graph to be identified based on the fusion of graph structure features, time sequence features and text semantic features. The graph is then input into a graph attention network that integrates a multi-head attention mechanism and a time decay factor, and the output risk score is used as the first score. The multi-dimensional risk control algorithm module is also used to generate temporal embeddings and structural embeddings based on temporal sequence features and graph structure features, respectively. The temporal embeddings and structural embeddings are concatenated to generate behavioral embeddings. The behaviors corresponding to the behavioral embeddings are compared and learned to generate a second score. The multi-dimensional risk control algorithm module is also used to determine the license category based on the license text in the text semantic features, and to perform rule reasoning by matching the corresponding conflict rule base according to the license category to obtain the conflict reasoning result; to generate the conflict probability based on the license knowledge graph in the component data; and to generate a third score based on the conflict reasoning result and the conflict probability. The risk fusion and decision-making module is used to weight and fuse the first, second, and third scores and output the risk level.

[0015] As a preferred option, the software supply chain risk identification system also includes: The visualization and alert module is used to display reminders pushed based on risk levels and trigger alerts.

[0016] The present invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the software supply chain risk identification method as described in any of the preceding embodiments.

[0017] Compared with the prior art, the beneficial effects of this invention are: This invention introduces innovative algorithms such as time-aware graph attention network, behavior graph + sequence hybrid modeling, and license knowledge graph reasoning, which realizes intelligent, dynamic, and multi-dimensional risk identification and assessment of software component sources, dependency chains, behavioral characteristics, and license compliance. It has the advantages of comprehensive detection, high accuracy, support for privacy protection, strong interpretability, and integration into CI / CD processes. Attached Figure Description

[0018] Figure 1 This is a flowchart of the software supply chain risk identification method according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of the processing of the time-aware graph attention network in Embodiment 1 of the present invention; Figure 3 This is a flowchart of the graph + sequence hybrid representation and contrastive learning model of Embodiment 1 of the present invention; Figure 4 This is a flowchart of the license knowledge graph construction and reasoning process in Embodiment 1 of the present invention; Figure 5 This is a module architecture diagram of the software supply chain risk identification system of Embodiment 1 of the present invention. Detailed Implementation

[0019] To more clearly illustrate the embodiments of the present invention, specific implementation methods will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0020] Example 1: like Figure 1 As shown, the software supply chain risk identification method of this embodiment includes the following steps: (1) Collect component data in the software supply chain; The component data in this embodiment includes component name, version number, dependency graph, behavior log, license text, and vulnerability information. Specifically, each time a code commit triggers a build, the data collection automatically scans all dependent libraries in the project and collects the following information: component name, version number, direct and indirect dependency graph, open source license text, known security vulnerability information, and runtime behavior log (e.g., API call sequence). Specifically, component metadata can be obtained through tools such as npm audit, Snyk, and osv, including component name, version number, dependency tree, known vulnerabilities, and CVSS score. The above behavior logs record the system calls, network connection targets, and file read / write paths of components running in a sandbox environment. The above license text is obtained by parsing the license field in package.json and retrieving the official SPDX text. Additionally, the timestamps are updated by obtaining the latest release date of each component from the npm registry.

[0021] (2) Extract features from the component data to form graph structure features, time sequence features and text semantic features respectively; Specifically, the collected component data undergoes feature extraction processing to generate input features suitable for different algorithm models; for Temporal-aware GAT, the dependency graph structure and its time-varying information are extracted; for behavioral graph + sequence hybrid modeling, the behavioral patterns of components during runtime are extracted as graph structure and sequence features; for license conflict detection, natural language processing techniques are used to parse the license text and identify potential conflict points. The graph structure features described above are: constructing a component dependency graph, with nodes containing node attributes, and edges labeled as direct / indirect and call frequency; the time sequence features described above are: converting behavior logs into API call sequences and using a sliding window to count the number of system calls per second; the text semantic features described above are: using BERT to encode the MIT license text to generate a 768-dimensional semantic vector; the specific details of the feature extraction described above can be found in existing technologies and will not be elaborated here.

[0022] (3) A multi-dimensional risk control algorithm is used to process the graph structure features, time sequence features and text semantic features to obtain the first score, second score and third score of the corresponding risk; Specifically, the multi-dimensional risk control algorithm consists of three parts: component dependency graph and propagation risk scoring, abnormal behavior of components, and license conflict detection; I. For component dependency graphs and risk scoring, this embodiment utilizes a time-aware graph attention network (i.e., a graph attention network that integrates multi-head attention mechanisms and time decay factors) to analyze component dependency graphs and propagate risk scores. It calculates the risk score for each node (i.e., component), considering the impact of direct and indirect dependencies and the influence of time factors on risk propagation. Based on traditional graph neural networks, a time-aware attention mechanism is introduced to dynamically model component update times and dependency chain propagation paths. An interpretable attention weight mechanism is also introduced to facilitate the analysis of propagation paths for high-risk components. The process of analyzing component dependency graphs and propagating risk scores is as follows: A relational graph to be identified is generated by fusing graph structure features, temporal sequence features, and textual semantic features. This graph is then input into a graph attention network that integrates a multi-head attention mechanism and a time decay factor. The output risk score is used as the first score. Figure 2 As shown, the specific algorithm design process is as follows: 1) Construct a dependency graph structure, where nodes are software components, such as react@18.2.0, lodash@4.17.19, etc.; edges represent dependencies, such as react depending on react-dom; node attributes include the number of vulnerabilities, average CVSS score, presence of known malicious behavior, source credibility, update frequency, etc.; edge attributes include dependency type (such as direct dependency, indirect dependency) and dependency strength (such as call frequency, code coverage). 2) Improved design of Graph Attention Network (GAT): Utilizes a multi-head attention mechanism, with each head learning a different dependency propagation path; introduces time-aware attention weights to calculate the attention coefficient between node i and node j. : ; in, Let be the embedding vector of node i. For learnable parameters, || represents the concatenation operation. Let i be the set of neighboring nodes of node i. The specific formula for calculating the attention coefficient can be found in existing technologies. In this embodiment, a time decay factor is introduced when the update time of component j is earlier than that of component i. : ; in, The attenuation coefficient is... and For the update timestamps of components i and j; 3) Risk propagation and score calculation: After each round of GAT propagation, the node risk score is updated. ; in, The new features (incorporating neighborhood information) output by the GAT in the l-th round of propagation for each node i. The activation function is used, and the definitions of other parameters can be found in existing technologies. Finally, the risk scores of each node are weighted and fused as the first score, which is combined with the original features and propagation information. The propagation path is visualized to assist in manual review.

[0023] Second, for abnormal behavior of components, this embodiment adopts a graph + sequence hybrid representation and contrastive learning model. It utilizes a graph neural network combined with a Transformer model to compare normal behavior patterns with the currently observed behavior sequence to identify abnormal behavior of components. Specifically, this embodiment inputs temporal sequence features into a Transformer encoder, outputting temporal embeddings; inputs graph structure features into a graph convolutional network, outputting structural embeddings; concatenates the temporal embeddings and structural embeddings and inputs them into a fully connected layer, outputting behavioral embeddings; performs contrastive learning on the behavior corresponding to the behavioral embedding, calculates its distance from the center of the normal row, and determines whether the distance is greater than the similarity value corresponding to maximizing positive samples and minimizing negative samples; if so, the distance is output as a second score; otherwise, the output second score is zero. This embodiment models component behavior as a hybrid representation of graph structure and time series, improving the ability to model complex behavioral patterns; it introduces a contrastive learning mechanism to enhance the model's ability to distinguish between normal and abnormal behavior; such as Figure 3 As shown, the algorithm design process is as follows: 1) Behavior log modeling: Collect component behavior logs, such as API call sequences, system calls, network connections, file read / write, etc.; construct a behavior graph: nodes represent behavior types (e.g., "call execve"); edges represent the temporal relationships between behaviors; and extract the temporal features of the behavior sequences (e.g., call frequency within a sliding window). 2) Hybrid Representation Learning: A Transformer encoder is used to model the behavior sequence, outputting a temporal embedding; a Graph Convolutional Network (GCN) is used to model the behavior graph, outputting a structural embedding; the two are concatenated and input into a fully connected layer to output a behavior embedding. ; in, For timing embedding, For structural embedding, MLP is for splicing; 3) Contrastive learning training strategy: Construct positive sample pairs: normal behavior + data augmentation (such as time perturbation); construct negative sample pairs: abnormal behavior (such as known malicious libraries); train the model using a contrastive loss function (such as normalized temperature-scaled cross-entropy loss NT-Xent) to maximize the similarity of positive samples and minimize the similarity of negative samples; the specific details of the above-mentioned normalized temperature-scaled cross-entropy loss NT-Xent can be found in existing technologies and will not be elaborated here. 4) Anomaly detection: After embedding the new behavior, calculate its distance from the center of the normal behavior; if the distance exceeds the similarity value corresponding to the maximum positive sample and the minimum negative sample, it is judged as an abnormal behavior and the distance is used as the second score output; otherwise, the output second score is zero.

[0024] III. For license conflict detection, this embodiment constructs a software license knowledge graph, integrating legal semantics and conflict rules; it uses a rule-based reasoning + graph neural network joint reasoning mechanism to discover potential license conflicts, improving the accuracy and interpretability of conflict identification. Specifically, this embodiment inputs the license text from the textual semantic features into the BERT model for encoding and license type classification, outputting the license category; it performs rule reasoning based on the license category and matches the corresponding conflict rule base to obtain the conflict reasoning result; where the conflict reasoning result is either conflict or no conflict; it inputs the license knowledge graph from the dependency graph into the graph neural network, outputting the conflict probability; if both the reasoning result and the graph neural network determine a conflict, the conflict probability is output as the third score; if only the graph neural network determines a conflict, the product of the conflict probability and a preset weight is output as the third score. Figure 4 As shown, the specific algorithm design process is as follows: 1) Construct a license knowledge graph: Nodes represent license types (e.g., MIT, GPL, Apache); edges represent conflict relationships, compatibility relationships, and dependency relationships; attributes represent license text, legal terms, usage restrictions, etc. 2) BERT-based semantic parsing: The BERT model is used to encode the license text, extract semantic features, and build a classification model to identify the license type; 3) Rule-based reasoning engine: Define a conflict rule base (e.g., GPL cannot be shared with closed-source code); define conflict logic using OWL or Prolog language; if component A uses GPL and component B uses a closed-source license, a conflict is triggered; 4) Graph Neural Network Inference Enhancement: Uses a Graph Neural Network (GNN) to learn potential conflicting paths between licenses; outputs the conflict probability and the conflicting paths; 5) Conflict decision-making mechanism: If both the rule engine and the GNN model determine that there is a conflict, a high-confidence conflict will be output; if only the GNN determines that there is a conflict, a potential conflict will be indicated.

[0025] As an example, after building the dependency graph, it was found that React depends on scheduler@0.23.0, and scheduler has one medium-risk vulnerability, CVSS=6.1, and the last update was in 2021; When GAT calculates the attention mechanism weights, the scheduler update time is much earlier than React's. (years), time decay factor Significantly reduce its impact on React (assuming) =0.5); After two layers of GAT propagation, the risk scores for each component are output: scheduler: RGAT = 0.72; react: GAT = 0.35 (not severely contaminated due to decay); lodash: GAT = 0.48 (contribution to its own vulnerability); The final score for the comprehensive component evaluation is: ; Input lodash behavior logs into the model: The Transformer encoder detected an abnormal pattern: "frequent reading of / etc / passwd + external non-CDN IPs"; the GCN behavior graph showed an abnormally high weight for the open→connect edge. The distance between the hybrid embedding E and the center of normal behavior is 0.87, which is greater than the threshold of 0.8, and is therefore judged as abnormal behavior. Output ; In the component list: React: IT; some-internal-lib: Source commercial license; In the license knowledge graph, MIT is compatible with closed-source software and there are no conflicts. However, another component, crypto-utils@1.0.0, uses GPL-3.0 (as confirmed by BERT classification). Rule engine trigger: GPL-3.0 cannot link with closed-source code → conflict; GNN also learned that there is a high probability of conflict between GPL and closed-source nodes, which is 0.93. Decision-making mechanism output: High-confidence conflict. That is, 0.93 * weight 0.95.

[0026] (4) The first, second, and third scores are weighted and combined to obtain the comprehensive score; Specifically, the overall score for this embodiment is: ; in, It received the highest rating. As the second-highest score, It received the third highest rating. , , These are the corresponding weight coefficients. The weighting coefficients can be dynamically adjusted according to the actual situation.

[0027] (5) Risk levels are determined based on the overall score; If the overall score is greater than 0.8, the risk level is classified as high risk; If 0.5 ≤ overall score ≤ 0.8, the risk level is classified as medium risk. If the overall score is less than 0.5, the risk level is classified as low risk.

[0028] As an example, ; ; It has been identified as a medium-risk area.

[0029] (6) Push reminder messages based on risk level; If the risk level is high, the warning message will be "It is recommended not to use it"; If the risk level is medium risk, the alert message will suggest review and replacement; If the risk level is low, the alert message is acceptable.

[0030] Based on the above-described software supply chain risk identification method, this embodiment also provides a corresponding software supply chain risk identification system, such as... Figure 5 As shown, it includes the following functional modules: data acquisition module, feature extraction module, multi-dimensional risk control algorithm module, risk fusion and decision-making module, and visualization and alarm module; The aforementioned data acquisition module is used to collect component data in the software supply chain; The aforementioned feature extraction module is used to extract features from component data to form graph structure features, time sequence features, and text semantic features, respectively. The aforementioned multi-dimensional risk control algorithm module is used to generate a relation graph to be identified based on the fusion of graph structure features, time sequence features and text semantic features, and input it into a graph attention network that integrates multi-head attention mechanism and time decay factor, and output a risk score as the first score; The aforementioned multi-dimensional risk control algorithm module is also used to input temporal sequence features into a Transformer encoder and output temporal embeddings; input graph structure features into a graph convolutional network and output structural embeddings; concatenate the temporal embeddings and structural embeddings and input them into a fully connected layer to output behavioral embeddings; perform comparative learning on the behaviors corresponding to the behavioral embeddings, calculate their distance from the center of the normal row, and determine whether the distance is greater than the similarity value corresponding to maximizing positive samples and minimizing negative samples; if so, the distance is output as the second score; if not, the output second score is zero. The aforementioned multi-dimensional risk control algorithm module is also used to input the license text from the semantic features of the text into the BERT model for encoding and license type classification, and output the license category; match the corresponding conflict rule base according to the license category for rule reasoning, and obtain the reasoning result; wherein, the reasoning result is conflict or no conflict; input the license knowledge graph in the dependency graph into the graph neural network, and output the conflict probability; if both the reasoning result and the graph neural network determine that there is a conflict, the conflict probability is used as the third score output; if only the graph neural network determines that there is a conflict, the product of the conflict probability and the preset weight is used as the third score output; The aforementioned risk fusion and decision-making module is used to perform weighted fusion of the first, second, and third scores and output a risk level; the risk fusion and decision-making module performs a comprehensive evaluation based on the risk scores output by each model, gives the final risk level, and generates a detailed report, including a list of risk components, score details, risk propagation path, and other information. The aforementioned visualization and alarm module is used to display reminders pushed according to risk levels and trigger alarms; it provides an intuitive visualization interface to display risk analysis results, issues warnings for high-risk components in a timely manner, and suggests taking corresponding mitigation measures or preventing problematic components from entering the production environment; The specific processing procedures for the above functional modules can be found in the detailed description of the software supply chain risk identification method described above, and will not be repeated here.

[0031] Furthermore, this embodiment employs federated learning training for model training and parameter aggregation across multiple organizations, supporting differential privacy and encrypted transmission. This mechanism utilizes a distributed architecture, where a central server coordinates the global model aggregation process, and each enterprise acts as a local client, independently training its model on its own dataset. To ensure model consistency, all clients and the central server use the same model structure, including core algorithms such as Temporal-aware GAT, behavior detection models, and license conflict detection models. Regarding privacy protection, the system introduces differential privacy noise before clients upload their local model parameters to prevent the inference of original training data through model updates. Simultaneously, homomorphic encryption or federated encryption mechanisms are used to encrypt transmitted parameters, ensuring data security during communication. After receiving model parameters uploaded by each client, the central server uses the FedAvg (Federated Averaging) algorithm to aggregate the parameters, generating an updated global model, which is then distributed to each client, enabling collaborative model optimization and continuous iteration. Through this federated learning mechanism, the system can effectively integrate multi-party data features without sharing original data, significantly improving the detection accuracy and adaptability of the software supply chain risk control model.

[0032] This invention significantly improves the accuracy, robustness, and practicality of software supply chain risk detection by introducing multi-dimensional intelligent algorithms. Specifically, the Temporal-aware Graph Attention Network (GAT) increases the risk propagation accuracy to 91.5% on real dependency graphs, a 13.3% improvement over traditional graph models; the graph + sequence hybrid contrastive learning model achieves an AUC of 0.94 for abnormal behavior detection, reducing the false positive rate to 3.1%; the knowledge graph-based license conflict detection covers more than 80 types of license relationships, achieving a detection rate of 96.8% and a false positive rate of only 2.4%; under the strong privacy protection of a differential privacy budget ε=2.0, federated learning maintains an F1 score of 0.89, approaching the level of centralized training; after the overall system integrates the outputs of multiple models, the end-to-end risk assessment accuracy reaches 94.2%, the false negative rate of high-risk components is as low as 1.7%, and the average detection time per component is only 2.3 seconds, fully meeting the needs for efficient, accurate, and privacy-secure supply chain risk control.

[0033] The computer-readable storage medium of this embodiment stores instructions that, when executed on a computer, cause the computer to perform the above-described software supply chain risk identification method, thereby achieving intelligent identification of software supply chain risks.

[0034] The above description is merely a detailed explanation of preferred embodiments and principles of the present invention. For those skilled in the art, there may be changes in specific implementation methods based on the ideas provided by the present invention, and these changes should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying risks in a software supply chain, characterized in that, Includes the following steps: S1. Collect component data from the software supply chain; S2. Extract features from the component data to form graph structure features, time sequence features, and text semantic features respectively; S3. Based on the fusion of graph structure features, temporal sequence features and text semantic features, a relation graph to be identified is generated and input into a graph attention network that integrates multi-head attention mechanism and time decay factor. The risk score is output as the first score. Temporal embeddings and structural embeddings are generated based on temporal sequence features and graph structure features, respectively. Temporal embeddings and structural embeddings are concatenated to generate behavioral embeddings. The behaviors corresponding to the behavioral embeddings are compared and learned to generate a second score. The license category is determined based on the license text in the text semantic features, and the corresponding conflict rule base is matched according to the license category to perform rule reasoning to obtain the conflict reasoning result; the conflict probability is generated based on the license knowledge graph in the component data; A third score is generated based on the conflict reasoning results and conflict probabilities; S4. Weight and merge the first, second, and third scores to obtain the comprehensive score; S5. Risk levels are determined based on the overall score.

2. The software supply chain risk identification method according to claim 1, characterized in that, In the graph attention network that integrates multi-head attention mechanism and time decay factor, components are nodes in the graph structure. If component j updates earlier than component i, a time decay factor is introduced to update the attention coefficient: ； in, The attenuation coefficient is... , For the update timestamps of components i and j, Let be the attention coefficient between the node corresponding to component i and the node corresponding to component j.

3. The software supply chain risk identification method according to claim 1, characterized in that, In step S3, the temporal sequence features are input into the Transformer encoder, and the temporal embedding is output. Input graph structure features into a graph convolutional network and output structure embeddings; The temporal embedding and the structural embedding are concatenated and then input into the fully connected layer, and the behavioral embedding is output. The behavior embedding is compared with the behavior, and the distance between it and the center of the normal row is calculated. It is then determined whether the distance is greater than the similarity value corresponding to the maximum positive sample and the minimum negative sample. If so, the distance is output as the second score; otherwise, the output second score is zero.

4. The software supply chain risk identification method according to claim 1, characterized in that, In step S3, the license text in the text semantic features is input into the BERT model for encoding and license type classification, and the license category is output. Based on the license category, the corresponding conflict rule base is matched to perform rule reasoning to obtain the conflict reasoning result; where the conflict reasoning result is either conflicting or not conflicting; Input the license knowledge graph in the dependency graph into the graph neural network, and output the conflict probability; If both the inference result and the graph neural network determine a conflict, the conflict probability is used as the third score output; if only the graph neural network determines a conflict, the product of the conflict probability and the preset weight is used as the third score output.

5. The software supply chain risk identification method according to claim 1, characterized in that, The overall score is: ； in, It received the highest rating. As the second-highest score, It received the third highest rating. , , These are the corresponding weight coefficients. .

6. The software supply chain risk identification method according to claim 1, characterized in that, The risk level classification based on the comprehensive score includes: If the overall score is greater than 0.8, the risk level is classified as high risk; If 0.5 ≤ overall score ≤ 0.8, the risk level is classified as medium risk. If the overall score is less than 0.5, the risk level is classified as low risk.

7. The software supply chain risk identification method according to claim 6, characterized in that, Also includes: Push notifications based on risk level; If the risk level is high, the warning message will be "It is recommended not to use it"; If the risk level is medium risk, the alert message will suggest review and replacement; If the risk level is low, the alert message is acceptable.

8. A software supply chain risk identification system, employing the software supply chain risk identification method as described in any one of claims 1-7, characterized in that, The software supply chain risk identification system includes: The data acquisition module is used to collect component data in the software supply chain; The feature extraction module is used to extract features from the component data to form graph structure features, time sequence features, and text semantic features, respectively. The multi-dimensional risk control algorithm module is used to generate a relation graph to be identified based on the fusion of graph structure features, time sequence features and text semantic features. The graph is then input into a graph attention network that integrates a multi-head attention mechanism and a time decay factor, and the output risk score is used as the first score. The multi-dimensional risk control algorithm module is also used to generate temporal embeddings and structural embeddings based on temporal sequence features and graph structure features, respectively. The temporal embeddings and structural embeddings are concatenated to generate behavioral embeddings. The behaviors corresponding to the behavioral embeddings are compared and learned to generate a second score. The multi-dimensional risk control algorithm module is also used to determine the license category based on the license text in the text semantic features, and to perform rule reasoning by matching the corresponding conflict rule base according to the license category to obtain the conflict reasoning result; to generate the conflict probability based on the license knowledge graph in the component data; and to generate a third score based on the conflict reasoning result and the conflict probability. The risk fusion and decision-making module is used to weight and fuse the first, second, and third scores and output the risk level.

9. The software supply chain risk identification system according to claim 8, characterized in that, Also includes: The visualization and alert module is used to display reminders pushed based on risk levels and trigger alerts.

10. A computer-readable storage medium storing instructions therein, characterized in that, When the instructions are executed on a computer, the computer performs the software supply chain risk identification method as described in any one of claims 1-7.

Images