A java dependency package security risk prediction method and device based on a graph neural network

Abstract

The application relates to the technical field of deep learning, and relates to a Java dependency package security risk prediction method and device based on a graph neural network, which comprises the following steps: acquiring dependency relationship data and known security vulnerability information of a Java dependency package, constructing a basic data set containing dependency relationship and vulnerability information, and constructing a Java dependency relationship directed graph; extracting original features of each node in the graph and performing numerical value processing to obtain a node comprehensive feature matrix; inputting the directed graph and the node comprehensive feature matrix into a preset graph neural network model, performing weighted aggregation on neighbor node features according to the dependency strength weight of a directed edge, and obtaining topological features of each node; outputting prediction probabilities of each node belonging to different security risk levels through a full connection layer of the graph neural network model, and determining the category corresponding to the maximum prediction probability as a risk level prediction result of the dependency package. The application can improve the timeliness and risk grading accuracy of Java dependency package security detection.

Description

Technical Field

[0001] This invention belongs to the field of deep learning technology, and in particular relates to a method and apparatus for predicting security risks of Java dependency packages based on graph neural networks. Background Technology

[0002] As software development becomes increasingly complex, software projects rely more and more on open-source components. The Maven Central repository in the Java ecosystem stores a large number of Java dependency packages, but some of these packages contain security vulnerabilities that could pose a serious security threat to the entire software supply chain. Existing dependency security analysis methods primarily rely on vulnerability databases and static analysis techniques, such as CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database), and the OSS Index. However, these methods struggle to predict undiscovered potential vulnerabilities. Furthermore, rule-based or traditional machine learning methods are ineffective at capturing complex dependency relationships.

[0003] Currently, supply chain security attacks are frequent. For example, the Log4j vulnerability (CVE-2021-44228) triggered a global security crisis, highlighting the importance of Java dependency security. Due to the complexity of Java dependency management, a single dependency package may indirectly depend on hundreds of other packages, making the propagation path of vulnerabilities difficult to trace. Traditional vulnerability scanning tools can often only detect known vulnerabilities and cannot predict potential security risks. Furthermore, existing research has shown that the topological characteristics of software dependencies can affect the propagation risk of vulnerabilities; therefore, static analysis based solely on CVE data has certain limitations.

[0004] In summary, existing technologies result in lower timeliness and accuracy of Java dependency security detection. Summary of the Invention

[0005] This invention provides a method and apparatus for predicting Java dependency package security risks based on graph neural networks, which can improve the timeliness of Java dependency package security detection and the accuracy of risk classification.

[0006] To achieve the above objectives, this invention provides a Java dependency package security risk prediction method based on graph neural networks, comprising: Obtain dependency data and known security vulnerability information from Java dependency packages, and use the dependency data and known security vulnerability information to construct a basic dataset containing dependencies and security vulnerabilities; Based on the base dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges. A Java dependency directed graph is then constructed based on the nodes and directed edges. The original feature information of each node in the Java dependency directed graph is extracted, and the original feature information is numerically mapped to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The Java dependency directed graph and the node comprehensive feature matrix are input into a preset graph neural network model. The features of neighboring nodes are weighted and aggregated according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node belonging to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

[0007] To address the above problems, the present invention also provides a Java dependency package security risk prediction device based on graph neural networks, the device comprising: The Java Dependency Directed Graph Construction Module is used to obtain dependency data and known security vulnerability information in Java dependency packages, and to construct a basic dataset containing dependencies and security vulnerabilities using the dependency data and known security vulnerability information; based on the basic dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges, and a Java dependency directed graph is constructed based on the nodes and directed edges; The feature extraction module is used to extract the original feature information of each node in the Java dependency directed graph and perform numerical mapping processing on the original feature information to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The risk level prediction module is used to input the Java dependency directed graph and the node comprehensive feature matrix into a preset graph neural network model. It performs weighted aggregation of the features of neighboring nodes according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

[0008] To address the above problems, the present invention also provides an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to execute the Java dependency package security risk prediction method based on graph neural networks described above.

[0009] To address the aforementioned problems, the present invention also provides a computer-readable storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the above-described method for predicting Java dependency package security risks based on graph neural networks.

[0010] This invention acquires dependency data and known security vulnerability information from Java dependency packages, and uses this data to construct a basic dataset containing dependencies and security vulnerabilities. This provides a structured and trainable data foundation for predicting security risks in Java dependency packages, improving the data completeness for subsequent risk identification. Furthermore, based on the basic dataset, dependency packages are mapped to nodes, and the dependencies between them are mapped to directed edges. A directed graph of Java dependencies is constructed based on the nodes and edges, transforming complex Java dependencies into a computable directed graph structure. This makes vulnerability propagation paths and dependency chains easier to identify and analyze using the graph model. Additionally, the original feature information of each node in the directed graph of Java dependencies is extracted and numerically mapped to obtain a comprehensive node feature matrix. This approach enables multi-dimensional quantitative representation of dependency packages, improving the comprehensiveness of features used for risk assessment. Furthermore, by inputting the directed graph of Java dependencies and the comprehensive feature matrix of nodes into a pre-defined graph neural network model, and weighting and aggregating the features of neighboring nodes based on the dependency strength weights of the directed edges, a topological representation of each node is obtained. This allows the model to automatically learn the impact of dependencies on security risk propagation, obtaining node topological representations that reflect dependency context and vulnerability propagation risks. Finally, based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the predicted risk level probability for each node's different security risk levels. The category corresponding to the highest predicted probability is selected as the predicted risk level of the dependency package, enabling automated prediction of low, medium, and high risk levels for dependency packages, improving the timeliness of Java dependency package security detection and the accuracy of risk classification. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a Java dependency package security risk prediction method based on graph neural networks, provided in an embodiment of the present invention. Figure 2This is a schematic diagram of a graph neural network model prediction method for predicting Java dependency package security risks according to an embodiment of the present invention. Figure 3 This is a functional block diagram of a Java dependency package security risk prediction device based on graph neural networks, provided in an embodiment of the present invention. Figure 4 This is a schematic diagram of the structure of an electronic device that implements the Java dependency package security risk prediction method based on graph neural networks, according to an embodiment of the present invention.

[0012] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0013] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0014] This application provides a method for predicting Java dependency package security risks based on graph neural networks. The execution entity of this method includes, but is not limited to, at least one of the following: a server, a terminal, or any electronic device configured to execute the method provided in this application. In other words, the method can be executed by software or hardware installed on a terminal device or a server device, where the software may be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cluster of cloud servers. The server can be an independent server or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0015] Reference Figure 1 The diagram shown is a flowchart illustrating a Java dependency package security risk prediction method based on graph neural networks according to an embodiment of the present invention. In this embodiment, the Java dependency package security risk prediction method based on graph neural networks includes: S1. Obtain dependency data and known security vulnerability information from Java dependency packages, and use the dependency data and known security vulnerability information to construct a basic dataset containing dependencies and security vulnerabilities.

[0016] Understandably, Java dependency packages refer to pre-compiled software components or third-party code libraries introduced during Java software development and building. More specifically, Java dependency packages are independent software modules hosted in public component repositories (such as Maven Central) that possess clearly defined semantic version numbers, package name identifiers (such as Group ID and Artifact ID), and specific functional logic. As fundamental building blocks of the software supply chain, dependency packages provide encapsulated application programming interfaces (APIs) for other projects to call.

[0017] Understandably, dependency data refers to structured connection information describing the mutual calls, nesting, or references between different Java dependency packages. For example, the pointing associations between components declared in the project build configuration file (such as the pom.xml file), that is, the one-way link between the dependent party (caller) and the dependent party (callee).

[0018] Understandably, known security vulnerability information refers to security flaws or risk records associated with specific Java dependency packages that have been publicly disclosed and included in authoritative security vulnerability databases. These authoritative security vulnerability databases include, but are not limited to, CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database), and OSS Index. OSS Index is a security vulnerability retrieval platform and database specifically for the open-source software component ecosystem.

[0019] S2. Based on the basic dataset, map dependency packages to nodes and the dependency relationships between dependency packages to directed edges, and construct a Java dependency directed graph based on the nodes and directed edges.

[0020] Understandably, a Java dependency directed graph refers to a basic graph theory structure consisting of a set of discrete nodes and a set of directed edges connecting these nodes. Each node uniquely corresponds to a Java dependency package assigned an integer index by a bidirectional mapping dictionary. Each directed edge has a clear directional attribute representing the direction from the source node of the dependency to the target node of the dependent, and also has a dependency strength weight attribute representing the degree of closeness between components.

[0021] Specifically, a directed graph of Java dependencies is constructed based on nodes and directed edges, including: Based on the established bidirectional mapping dictionary, the names of the pre-deduplicated dependency packages are converted from string format to consecutive integer indices starting from zero, resulting in node digitization. Based on the node digitization results, a sparse dependency matrix is ​​constructed using a coordinate list format. The sparse dependency matrix uses a row index array to store the integer indices of the dependents, a column index array to store the integer indices of the dependents, and a value array to store the dependency strength weights of the directed edges. Output a Java dependency graph based on the sparse dependency matrix as the data representation structure.

[0022] Understandably, a bidirectional mapping dictionary refers to a data structure that supports bidirectional mapping queries of key-value pairs.

[0023] Understandably, the coordinate list format refers to a structured storage specification specifically used to record the coordinate positions and corresponding values ​​of non-zero elements in a matrix.

[0024] Understandably, a sparse dependency matrix is ​​a two-dimensional numerical array model in which most matrix elements take the value of zero, and the discretely distributed non-zero elements precisely map the real upstream and downstream dependency links.

[0025] For example, based on the base dataset, mapping dependency packages to nodes and mapping the dependencies between dependency packages to directed edges, and constructing a Java dependency directed graph based on the nodes and directed edges, can be achieved using the following implementation steps; Step 1: Dependency packages are treated as nodes in a graph, with each node representing a Java dependency package; Step 2: Dependencies are treated as directed edges. If dependent package A depends on package B, then add a directed edge from A to B in the graph. Step 3: Construct a sparse dependency matrix using a coordinate list (COO) format. Step 4, Node Digitization (ID Mapping): Since the original dependency package names are in string format, they cannot be directly used for matrix operations. Therefore, a bidirectional mapping dictionary is created. The N deduplicated dependency packages are mapped to unique integer indices from 0 to N-1. For example, "log4j-core:2.14.1" has an index of 0; "spring-web:5.3.1" has an index of 1. Step 5: Construct the COO sparse matrix: Only store edges with dependencies, consisting of three one-dimensional arrays: Row Indices: store the integer indices of the dependent (source node); Col Indices: store the integer indices of the dependent (target node); Values: store the weights of the edges (e.g., 1 by default); Storage example: If the packet at index 0 depends on the packet at index 1, then store Row=[0], Col=[1], Value=[1] in the array respectively; The above structure avoids storing a large number of non-dependent regions with a value of 0, optimizing the space complexity to O(E) (E is the number of edges).

[0026] S3. Extract the original feature information of each node in the Java dependency directed graph, and perform numerical mapping processing on the original feature information to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features.

[0027] Specifically, the static features in the node comprehensive feature matrix are obtained, including: Extract vulnerability scores from known security vulnerability information, and fill the vulnerability score feature bits with preset negative value flags when there are no vulnerability records. Map the semantic version number in the basic information of Java dependency packages to a relative timestamp index to build version timing features; The number of code commits within a preset time period is counted in the basic information of Java dependency packages, and the maintenance frequency characteristics are obtained by processing with a logarithmic smoothing formula. The impact range encoding feature is obtained by mapping the textual description of the vulnerability's impact range in the vulnerability data to discrete numerical values. Static features are obtained by combining vulnerability scores, version timing characteristics, maintenance frequency characteristics, and impact scope coding characteristics.

[0028] Understandably, the vulnerability rating feature bit refers to the dedicated data storage slot that is pre-allocated in the multiple feature dimensions of the node's comprehensive feature matrix. The storage slot is strictly designated to carry the quantitative rating value extracted from the authoritative vulnerability database and numerically mapped, which represents the severity of the known security flaws contained in the dependency package. It is the core quantitative evaluation parameter that constitutes the node's static security attributes.

[0029] Understandably, the negative value flag refers to a specific replacement value that is less than zero.

[0030] Understandably, the logarithmic smoothing formula refers to a nonlinear numerical mapping calculation rule based on the properties of the logarithmic function.

[0031] Furthermore, the topological features in the node comprehensive feature matrix are obtained, including: Calculate the in-degree centrality of a node that is directly dependent on a downstream node, and the out-degree centrality of a node that is directly dependent on an upstream node, based on the adjacency relationships in the Java dependency directed graph. Based on the out-degree centrality of the nodes and the preset damping coefficient, the global importance weight score of the nodes is calculated using an iterative algorithm. The hub value and authority value of each node are calculated through alternating iterations; Topological features are obtained by combining access degree centrality, out-degree centrality, global importance weight scores, hub value, and authority value.

[0032] Understandably, in-degree centrality is a topological measure that characterizes the number of connections a specific node in a network graph model receives as the destination of directed edges.

[0033] It is understandable that out-degree centrality is a topological measure that characterizes the number of connections initiated by a specific node as the starting point of a directed edge in a network graph model.

[0034] Understandably, the preset damping coefficient refers to a fixed attenuation control scalar that is pre-allocated when calculating the global importance weights of the network.

[0035] Understandably, an iterative algorithm refers to a numerical computation procedure that is based on an initial system state and performs iterative calculations according to a specific state transition equation. For example, with a set initial weight vector as the triggering starting point, the algorithm continuously refreshes the weight and role metric scores of each node by repeatedly performing matrix multiplication and vector accumulation operations on adjacent nodes of the network until the data deviation of the feature matrix obtained from two adjacent iterations falls completely within the predefined error tolerance range.

[0036] Understandably, hub value refers to a strength index used in a directed graph bilateral role evaluation mechanism to characterize the strength of a specific node's attribute as a resource aggregation hub node.

[0037] Understandably, authority value refers to a strength index used in a directed graph bilateral role evaluation mechanism to characterize the strength of a specific node's attribute as a basic resource provider.

[0038] For example, obtaining the topological features in the node comprehensive feature matrix can be achieved using the following implementation steps: Step 1, Degree Centrality Calculation: Define an adjacency matrix A. If dependent bag i depends on bag j, then A... ij =1, otherwise 0, where in-degree This indicates how many downstream packages directly depend on package i, reflecting the direct impact range in the event of a failure. The calculation formula is: ; out-degree This indicates how many upstream packages dependency package i directly depends on, reflecting the attack surface size that introduces potential vulnerabilities. Let be the set of nodes. The calculation formula is: ; Step 3, PageRank Importance Assessment: This measures the global importance of a dependency package within the entire ecosystem. Assume PR(i) is the PageRank value of node i, d is the damping coefficient (usually 0.85), M(i) is the set of nodes pointing to node i, and L(j) is the out-degree of node j. An iterative method is used until convergence. The total number of nodes is calculated using the following formula: ; Step 4, HITS (Hyperlink-Induced Topic Search) Algorithm Analysis: This involves iteratively calculating the Hub Score and Authority Score of each node to differentiate the roles of dependent packages: Authority Score... Update (the package pointed to by a high-quality hub is the authoritative package, usually the underlying base library). For dependency packages Point to dependency package : ; Hub value Update (the package that points to a high-quality, authoritative one is the hub package, which is usually an integration framework). For dependency packages Point to dependency package : .

[0039] Furthermore, the dynamic features in the node comprehensive feature matrix are obtained, including: Use performance monitoring tools to collect runtime data and extract the call frequency and memory usage characteristics of dependency packages; Extract alarm information from the log analysis system, and count the number of abnormal warning events associated with each dependent package and the frequency of error events. Dynamic features are obtained by concatenating vectors of call frequency, memory usage characteristics, number of abnormal warning events, and frequency of error events.

[0040] S4. Input the Java dependency directed graph and the node comprehensive feature matrix into the preset graph neural network model, and perform weighted aggregation of the features of neighboring nodes according to the dependency strength weight of the directed edges to obtain the topological representation of each node.

[0041] Understandably, a pre-defined graph neural network model refers to a pre-set multi-layer neural network algebraic operation architecture. For example, pre-defined graph neural network models include, but are not limited to, GCN (Graph Convolutional Network), GAT (Graph Attention Network), and GraphSAGE (Graph Sampling and Aggregation Network).

[0042] Specifically, the process involves inputting the Java dependency directed graph and the node comprehensive feature matrix into a pre-defined graph neural network model, and also includes training the pre-defined graph neural network model. Use an input dataset containing known vulnerability data as training samples and assign classification labels to the corresponding nodes; A mini-batch training method based on multi-hop neighbor sampling is used to perform forward propagation in a multi-layer aggregation network, and a non-linear activation function is used to perform non-linear mapping on the feature representation vector. Based on the predicted probability and the classification label, the model error is calculated using a weighted cross-entropy loss function, which includes weighted coefficients for different risk categories and a regularization penalty term that includes the sum of squares of all trainable parameters. The gradient of the weighted cross-entropy loss function with respect to the model parameters is calculated using an adaptive optimizer, and backpropagation parameter updates are performed.

[0043] Understandably, multi-hop neighbor sampling refers to the process of training a graph neural network model by extracting a certain number of neighboring nodes from the target node's adjacent nodes layer by layer, centered on the target node in the current batch, according to a preset number of aggregation layers or hops, in order to construct a local computational subgraph for forward propagation and parameter updates.

[0044] Understandably, the weighted cross-entropy loss function is a loss function that sets different class weights for different risk categories based on the cross-entropy loss function. It is used to measure the difference between the predicted probability output by the graph neural network model and the true classification label. Among them, for risk categories with fewer samples or higher safety importance, a larger weighting coefficient is set to increase the degree of punishment when the model makes a wrong prediction for this type of sample.

[0045] Understandably, an adaptive optimizer is an optimization algorithm that can adaptively adjust the learning rate of each parameter based on the gradient changes of the model parameters during training.

[0046] For example, inputting the Java dependency directed graph and the node comprehensive feature matrix into a preset graph neural network model, and further training the preset graph neural network model, can be implemented using the following steps: using known CVE vulnerability data as label information for training samples for supervised learning; employing node embedding technology to vectorize dependency packages and learn their topological features and security risk patterns; during training, using a mini-batch training optimization method based on multi-hop neighbor sampling to improve the computational efficiency of large-scale dependency graphs and alleviate the memory overflow problem of full-batch training when dealing with large-scale dependency graphs. The specific process is as follows: Step 1: Mini-batch Generation. At the beginning of each training epoch, the target nodes (i.e., dependency packages known to have / not have vulnerability labels) in the training set are randomly shuffled and divided into several batches of size B (e.g., B=1024). Step 2: Layer-wise Neighbor Sampling. For the target node set in each batch, perform K layers of recursive sampling from the outside in to construct a computational subgraph: Set the sampling threshold S for each layer k. k (For example, 10 nodes are sampled in layer 1 and 25 nodes are sampled in layer 2). For each node in layer k, S nodes are randomly selected from its adjacency list. k There are S neighbor nodes. If the number of neighbors is less than S k If the value is greater than S, then select all neighbors; k Then, random sampling without replacement is performed. Technical effect: Step 2 limits the receptive field of a single node to a fixed size, preventing the phenomenon of "exponential growth of neighbor size" and ensuring that memory usage does not increase with the expansion of the graph size.

[0047] Step 3: Subgraph Feature Aggregation and Parameter Update; Based on the sampled subgraph structure, feature data is aggregated layer by layer from the Kth layer neighbors to the target node. The loss between the predicted value and the true label (vulnerability status) is calculated, and the model parameters are updated using the backpropagation algorithm.

[0048] S5. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node belonging to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

[0049] For example, based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the predicted risk level probability of each node belonging to different security risk levels, and the category corresponding to the highest predicted probability is selected as the risk level prediction result of the dependency package. This can be achieved by the following implementation steps: Step 1: Access and vectorize the node under test. Parse the pom.xml file and bytecode of the dependent package under test, extract its static attributes (such as version number and maintainer) and local topology (i.e., the direct child dependencies referenced by the package), and construct the feature vector x of the node. target and its local adjacency relationships; Step 2: Graph Embedding Generation and Forward Propagation. The node to be tested is temporarily integrated into the existing dependency graph, and forward propagation is performed using the trained GNN model parameters: Neighbor Aggregation: The model aggregates the feature information of the K-hop neighbors of the node to be tested and calculates its hidden layer state; Embedding Update: Combining the node's own features x... target Using the aggregated neighbor features, the final node embedding vector of the unknown node is generated, which contains its structural position and potential risk patterns in the current dependent network.

[0050] Step 3: Classification Mapping and Confidence Output. The generated graph embedding vector is input into the fully connected layer (MLP) and Softmax classifier of the model to calculate the probability distribution of the node belonging to each risk level. The class with the highest probability is selected as the final prediction result, and this probability value is used as the prediction confidence score.

[0051] Step 4: Prediction Output: Risk level of dependent packages (low, medium, high); range of potentially affected versions; possible vulnerability types and potential attack methods, such as RCE (Remote Code Execution), information disclosure, etc.

[0052] Specifically, after selecting the category corresponding to the highest predicted probability as the risk level prediction result of the dependency package, the process also includes executing a security configuration policy: When the risk level prediction result of the downstream dependent node is determined to match the preset high-risk category, the direct parent node is searched in reverse in the directed dependency graph, and blocking and version upgrade instructions are generated for the direct parent node. When a specific high-risk node is identified, a depth-first search algorithm is used to perform dependency reachability analysis on all available versions of upstream components. In the directed dependency graph, dependency paths that do not contain the specific high-risk node are selected and the corresponding upgrade version number is output. The maximum predicted probability is extracted as the prediction confidence level, and the scanning and blocking configuration parameters are adjusted based on the prediction confidence level and risk level prediction results.

[0053] For example, the security configuration policy includes: (1) Link blocking strategy based on graph backtracking: When a downstream dependent node is detected to be high-risk (such as containing CVE or being predicted to be high-risk) and cannot be repaired independently, the system searches for its direct parent node in reverse traversal of the dependency graph and generates a forced upgrade or interception suggestion for the upstream parent node, aiming to cut off the risk introduction from the call chain entry point.

[0054] (2) Secure path search strategy based on graph reachability analysis: For malicious nodes deep in the dependency chain (such as dependency package X which is suspected of having supply chain attack risks), the system uses the DFS (Depth-First Search) algorithm to perform dependency reachability analysis on all available versions of upstream components (such as package H). The system then selects the minimum upgrade version that does not contain malicious nodes in the dependency path, generates a "minimum secure upgrade path" suggestion, and guides developers to reconstruct the dependency tree.

[0055] The resource scheduling strategy is based on confidence level: the defense strategy is dynamically adjusted according to the confidence score and risk level output by the model. For low-risk components with high confidence, a suggestion to "reduce scanning frequency" is generated to save computing resources; for potentially risky components, a suggestion to "include in the real-time monitoring list" is generated, and the CI / CD pipeline is integrated for automated blocking.

[0056] This invention acquires dependency data and known security vulnerability information from Java dependency packages, and uses this data to construct a basic dataset containing dependencies and security vulnerabilities. This provides a structured and trainable data foundation for predicting security risks in Java dependency packages, improving the data completeness for subsequent risk identification. Furthermore, based on the basic dataset, dependency packages are mapped to nodes, and the dependencies between them are mapped to directed edges. A directed graph of Java dependencies is constructed based on the nodes and edges, transforming complex Java dependencies into a computable directed graph structure. This makes vulnerability propagation paths and dependency chains easier to identify and analyze using the graph model. Additionally, the original feature information of each node in the directed graph of Java dependencies is extracted and numerically mapped to obtain a comprehensive node feature matrix. This approach enables multi-dimensional quantitative representation of dependency packages, improving the comprehensiveness of features used for risk assessment. Furthermore, by inputting the directed graph of Java dependencies and the comprehensive feature matrix of nodes into a pre-defined graph neural network model, and weighting and aggregating the features of neighboring nodes based on the dependency strength weights of the directed edges, a topological representation of each node is obtained. This allows the model to automatically learn the impact of dependencies on security risk propagation, obtaining node topological representations that reflect dependency context and vulnerability propagation risks. Finally, based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the predicted risk level probability for each node's different security risk levels. The category corresponding to the highest predicted probability is selected as the predicted risk level of the dependency package, enabling automated prediction of low, medium, and high risk levels for dependency packages, improving the timeliness of Java dependency package security detection and the accuracy of risk classification.

[0057] Reference Figure 2 The diagram shown is a graph neural network model prediction diagram of a Java dependency package security risk prediction method based on graph neural networks provided in an embodiment of the present invention.

[0058] like Figure 3 The diagram shown is a functional block diagram of a Java dependency package security risk prediction device based on a graph neural network according to an embodiment of the present invention.

[0059] The Java dependency package security risk prediction device 100 based on graph neural networks described in this invention can be installed in an electronic device. Depending on the functions implemented, the Java dependency package security risk prediction device 100 may include a Java dependency relation directed graph construction module 101, a feature extraction module 102, and a risk level prediction module 103.

[0060] The module described in this invention can also be called a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0061] In this embodiment, the functions of each module / unit are as follows: The Java dependency directed graph construction module 101 is used to obtain dependency data and known security vulnerability information in Java dependency packages, and to construct a basic dataset containing dependencies and security vulnerabilities using the dependency data and known security vulnerability information; based on the basic dataset, it maps dependency packages to nodes and the dependency relationships between dependency packages to directed edges, and constructs a Java dependency directed graph based on the nodes and directed edges.

[0062] The feature extraction module 102 is used to extract the original feature information of each node in the Java dependency directed graph and perform numerical mapping processing on the original feature information to obtain a node comprehensive feature matrix. The node comprehensive feature matrix includes static features, topological features and dynamic features.

[0063] The risk level prediction module 103 is used to input the Java dependency directed graph and the node comprehensive feature matrix into a preset graph neural network model, and to perform weighted aggregation of the features of neighboring nodes according to the dependency strength weight of the directed edges to obtain the topological representation of each node; based on the topological representation of each node, the fully connected layer of the graph neural network model is used to output the risk level prediction probability of each node to different security risk levels, and the category corresponding to the highest prediction probability is selected as the risk level prediction result of the dependency package.

[0064] like Figure 4 The diagram shown is a schematic representation of an electronic device that implements a Java dependency package security risk prediction method based on a graph neural network, according to an embodiment of the present invention.

[0065] The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13. It may also include a computer program stored in the memory 11 and capable of running on the processor 10, such as a Java dependency package security risk prediction method program based on graph neural networks.

[0066] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the core control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., executing a Java dependency package security risk prediction method program based on graph neural networks), and calls data stored in the memory 11 to perform various functions of the electronic device and process data.

[0067] The memory 11 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device. The memory 11 can be used not only to store application software and various types of data installed on the electronic device, such as the code of a Java dependency package security risk prediction method program based on graph neural networks, but also to temporarily store data that has been output or will be output.

[0068] The communication bus 12 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0069] The communication interface 13 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), or optionally, a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0070] Figure 4 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 4 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0071] For example, although not shown, the electronic device may also include a power supply (such as a battery) to power the various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0072] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0073] Obtain dependency data and known security vulnerability information from Java dependency packages, and use the dependency data and known security vulnerability information to construct a basic dataset containing dependencies and security vulnerabilities; Based on the base dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges. A Java dependency directed graph is then constructed based on the nodes and directed edges. The original feature information of each node in the Java dependency directed graph is extracted, and the original feature information is numerically mapped to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The Java dependency directed graph and the node comprehensive feature matrix are input into a preset graph neural network model. The features of neighboring nodes are weighted and aggregated according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node belonging to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

[0074] Specifically, the specific implementation method of the processor 10 for the above instructions can be referred to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, and will not be repeated here.

[0075] Furthermore, if the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0076] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor of an electronic device, can perform the following: Obtain dependency data and known security vulnerability information from Java dependency packages, and use the dependency data and known security vulnerability information to construct a basic dataset containing dependencies and security vulnerabilities; Based on the base dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges. A Java dependency directed graph is then constructed based on the nodes and directed edges. The original feature information of each node in the Java dependency directed graph is extracted, and the original feature information is numerically mapped to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The Java dependency directed graph and the node comprehensive feature matrix are input into a preset graph neural network model. The features of neighboring nodes are weighted and aggregated according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node belonging to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

[0077] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0078] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0079] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0080] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0081] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0082] The blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0083] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0084] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a system claim may also be implemented by a single unit or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any specific order.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for predicting Java dependency package security risks based on graph neural networks, characterized in that, The method includes: Obtain dependency data and known security vulnerability information from Java dependency packages, and use the dependency data and known security vulnerability information to construct a basic dataset containing dependencies and security vulnerabilities; Based on the base dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges. A Java dependency directed graph is then constructed based on the nodes and directed edges. The original feature information of each node in the Java dependency directed graph is extracted, and the original feature information is numerically mapped to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The Java dependency directed graph and the node comprehensive feature matrix are input into a preset graph neural network model. The features of neighboring nodes are weighted and aggregated according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node belonging to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

2. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, The construction of the Java dependency directed graph based on nodes and directed edges includes: Based on the established bidirectional mapping dictionary, the names of the pre-deduplicated dependency packages are converted from string format to consecutive integer indices starting from zero, resulting in node digitization. Based on the node digitization results, a sparse dependency matrix is ​​constructed using a coordinate list format. The sparse dependency matrix uses a row index array to store the integer indices of the dependents, a column index array to store the integer indices of the dependents, and a value array to store the dependency strength weights of the directed edges. Output a Java dependency graph based on the sparse dependency matrix as the data representation structure.

3. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, Obtain the static features from the node comprehensive feature matrix, including: Extract vulnerability scores from known security vulnerability information, and fill the vulnerability score feature bits with preset negative value flags when there are no vulnerability records. Map the semantic version number in the basic information of Java dependency packages to a relative timestamp index to build version timing features; The number of code commits within a preset time period is counted in the basic information of Java dependency packages, and the maintenance frequency characteristics are obtained by processing with a logarithmic smoothing formula. The impact range encoding feature is obtained by mapping the textual description of the vulnerability's impact range in the vulnerability data to discrete numerical values. Static features are obtained by combining vulnerability scores, version timing characteristics, maintenance frequency characteristics, and impact scope coding characteristics.

4. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, Obtain the topological features from the node comprehensive feature matrix, including: Calculate the in-degree centrality of a node that is directly dependent on a downstream node, and the out-degree centrality of a node that is directly dependent on an upstream node, based on the adjacency relationships in the Java dependency directed graph. Based on the out-degree centrality of the nodes and the preset damping coefficient, the global importance weight score of the nodes is calculated using an iterative algorithm. The hub value and authority value of each node are calculated through alternating iterations; Topological features are obtained by combining access degree centrality, out-degree centrality, global importance weight scores, hub value, and authority value.

5. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, Obtain the dynamic features from the node comprehensive feature matrix, including: Use performance monitoring tools to collect runtime data and extract the call frequency and memory usage characteristics of dependency packages; Extract alarm information from the log analysis system, and count the number of abnormal warning events associated with each dependent package and the frequency of error events. Dynamic features are obtained by concatenating vectors of call frequency, memory usage characteristics, number of abnormal warning events, and frequency of error events.

6. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, The step of inputting the Java dependency directed graph and the node comprehensive feature matrix into a preset graph neural network model also includes training the preset graph neural network model: Use an input dataset containing known vulnerability data as training samples and assign classification labels to the corresponding nodes; A mini-batch training method based on multi-hop neighbor sampling is used to perform forward propagation in a multi-layer aggregation network, and a non-linear activation function is used to perform non-linear mapping on the feature representation vector. Based on the predicted probability and the classification label, the model error is calculated using a weighted cross-entropy loss function, which includes weighted coefficients for different risk categories and a regularization penalty term that includes the sum of squares of all trainable parameters. The gradient of the weighted cross-entropy loss function with respect to the model parameters is calculated using an adaptive optimizer, and backpropagation parameter updates are performed.

7. The Java dependency package security risk prediction method based on graph neural networks as described in claim 1, characterized in that, After selecting the category corresponding to the highest predicted probability as the risk level prediction result of the dependency package, the process also includes executing a security configuration policy: When the risk level prediction result of the downstream dependent node is determined to match the preset high-risk category, the direct parent node is searched in reverse in the directed dependency graph, and blocking and version upgrade instructions are generated for the direct parent node. When a specific high-risk node is identified, a depth-first search algorithm is used to perform dependency reachability analysis on all available versions of upstream components. In the directed dependency graph, dependency paths that do not contain the specific high-risk node are selected and the corresponding upgrade version number is output. The maximum predicted probability is extracted as the prediction confidence level, and the scanning and blocking configuration parameters are adjusted based on the prediction confidence level and risk level prediction results.

8. A Java dependency package security risk prediction device based on graph neural networks, characterized in that, The apparatus is used to implement the Java dependency package security risk prediction method based on graph neural networks as described in any one of claims 1 to 7, and the apparatus comprises: The Java Dependency Directed Graph Construction Module is used to obtain dependency data and known security vulnerability information in Java dependency packages, and to construct a basic dataset containing dependencies and security vulnerabilities using the dependency data and known security vulnerability information; based on the basic dataset, dependency packages are mapped to nodes and the dependency relationships between dependency packages are mapped to directed edges, and a Java dependency directed graph is constructed based on the nodes and directed edges; The feature extraction module is used to extract the original feature information of each node in the Java dependency directed graph and perform numerical mapping processing on the original feature information to obtain the node comprehensive feature matrix, which includes static features, topological features and dynamic features. The risk level prediction module is used to input the Java dependency directed graph and the node comprehensive feature matrix into a preset graph neural network model. It performs weighted aggregation of the features of neighboring nodes according to the dependency strength weight of the directed edges to obtain the topological representation of each node. Based on the topological representation of each node, the fully connected layer of the graph neural network model outputs the risk level prediction probability of each node to different security risk levels, and selects the category corresponding to the highest prediction probability as the risk level prediction result of the dependency package.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the Java dependency package security risk prediction method based on graph neural networks as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the Java dependency package security risk prediction method based on graph neural networks as described in any one of claims 1 to 7.

Images