Method, device and equipment for trusted fusion of multi-source data of software supply chain, storage medium and program product

Abstract

This application relates to a reliable fusion method, apparatus, device, storage medium, and program product for multi-source data in a software supply chain. The method includes: acquiring multi-source data from the software supply chain, including structured data and textual claims; generating normalized records based on the structured data; converting the textual claims into atomic assertions; resolving conflicts between the normalized records and the atomic assertions; and fusing the conflict-resolved results to generate a reliable dataset, which characterizes the reliable result of the multi-source data fusion. This method can provide a reliable data source for supply chain security assessment.

Description

Technical Field

[0001] This application relates to the field of software supply chain security data processing and artificial intelligence-assisted analysis technology, and in particular to a trusted fusion method, apparatus, device, storage medium and program product for multi-source data in the software supply chain. Background Technology

[0002] With the increasing frequency of software supply chain attacks, operators of critical information infrastructure have an increasingly urgent need for continuous assessment of the security status of their suppliers, leading to the emergence of supplier security assessment platform technology. These platforms can access various data sources, including vulnerability scanners, ticketing systems, software bill of materials (SBOM) collection platforms, and supplier reporting portals, and can quantitatively score and display trends for suppliers in areas such as vulnerability remediation and open-source component management.

[0003] However, the aforementioned quantitative scoring and trend display rely on the effective integration of multi-source data. When processing multi-source data, existing technologies typically perform simple field mapping and unit conversion on various data sources, and then directly integrate and use the data from different sources after converting them into structured records.

[0004] However, different data sources have significant differences in field definitions, units of measurement, and time granularity. Simply mapping fields and converting units across various data sources cannot resolve the semantic heterogeneity of the same indicator across different sources. Furthermore, when inconsistencies arise between multiple data sources, there is a lack of a quantitative reliability assessment mechanism to determine which data source to choose. This results in the reliability of the integrated multi-source data being compromised, making it difficult to support subsequent security assessment decisions. Summary of the Invention

[0005] Therefore, it is necessary to provide a reliable fusion method, apparatus, equipment, storage medium, and program product for multi-source data in the software supply chain to address the aforementioned technical problems.

[0006] Firstly, this application provides a trusted fusion method for multi-source data in a software supply chain, including:

[0007] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0008] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0009] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0010] In one embodiment, generating normalized records from structured data includes:

[0011] The structured data is mapped to its fields to obtain the first structured data.

[0012] The first structured data is normalized to obtain the second structured data;

[0013] The second structured data is aligned using time windows to generate normalized records.

[0014] In one embodiment, converting a textualized statement into an atomic assertion includes:

[0015] Candidate sentences are selected from the textual declaration according to the preset filtering rules. The filtering rules include keyword matching and quantitative expression pattern matching.

[0016] The candidate sentences are input into a natural language model for transformation to obtain the initial atomic assertions;

[0017] The initial atomic assertion is validated to generate the atomic assertion. The validation includes format validation, range validation and confidence validation.

[0018] In one embodiment, the normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are fused to generate a trusted dataset, including:

[0019] Normalized records with the same supplier identifier, the same indicator identifier, and overlapping time windows are grouped together with atomic assertions to obtain multiple comparison groups.

[0020] Conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results;

[0021] When there are conflicts within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation.

[0022] When there are no conflicts within the comparison group, the normalized record and atomic assertion of the comparison group are determined as the fusion result of the comparison group.

[0023] The fusion results of each comparison group are summarized to generate a reliable dataset.

[0024] In one embodiment, conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results, including:

[0025] Operator logic is used to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0026] When the actual observed value does not meet the comparison criteria with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection.

[0027] When the actual observed value and the claimed value meet the comparison criteria, calculate the deviation between the actual observed value and the claimed value;

[0028] When the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion.

[0029] When the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of conflict detection.

[0030] In one embodiment, when conflicts exist within the comparison group, the fusion result of the comparison group is determined according to preset priority rules and confidence calculations, including:

[0031] If a conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on a preset priority rule;

[0032] If a conflict occurs between normalized records and atomic assertions, the confidence levels of the normalized records and atomic assertions are calculated separately, and the one with the highest confidence level is selected as the fusion result of the comparison group.

[0033] Secondly, this application also provides a trusted fusion device for multi-source data in the software supply chain, comprising:

[0034] The acquisition module is used to acquire multi-source data from the software supply chain, including structured data and textual declarations.

[0035] The transformation module is used to generate normalized records from structured data and convert textual declarations into atomic assertions;

[0036] The conflict resolution module is used to resolve conflicts between normalized records and atomic assertions, and then merge the conflict-resolved results to generate a trusted dataset. The trusted dataset is used to characterize the trusted results after the fusion of multi-source data.

[0037] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0038] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0039] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0040] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0041] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0042] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0043] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0044] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0045] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0046] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0047] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0048] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0049] The aforementioned trusted fusion method, apparatus, equipment, storage medium, and program product for multi-source data in the software supply chain acquires multi-source data from the software supply chain, including structured data and textual claims; generates normalized records based on the structured data and converts textual claims into atomic assertions; resolves conflicts between the normalized records and atomic assertions, and fuses the conflict-resolved results to generate a trusted dataset. This trusted dataset represents the trusted result of the multi-source data fusion. The method can uniformly convert structured data and textual claims from different sources and formats into normalized records and atomic assertions, making the multi-source data comparable. Furthermore, through conflict resolution, it can identify and eliminate logical and numerical conflicts between data from different sources, thereby generating a unified trusted dataset. Each record in this trusted dataset has undergone conflict detection and credibility assessment, providing a reliable data source for supply chain security assessment. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is an application environment diagram of a trusted fusion method for multi-source data in a software supply chain, as shown in one embodiment.

[0052] Figure 2 This is one of the flowcharts illustrating a trusted fusion method for multi-source data in a software supply chain, as shown in one embodiment.

[0053] Figure 3 This is a second flowchart illustrating a trusted fusion method for multi-source data in a software supply chain, as described in one embodiment.

[0054] Figure 4 This is the third flowchart illustrating a trusted fusion method for multi-source data in a software supply chain, as described in one embodiment.

[0055] Figure 5 This is the fourth flowchart illustrating a trusted fusion method for multi-source data in a software supply chain, as described in one embodiment.

[0056] Figure 6 This is the fifth flowchart illustrating a trusted fusion method for multi-source data in a software supply chain, as described in one embodiment.

[0057] Figure 7 This is the sixth flowchart illustrating a trusted fusion method for multi-source data in a software supply chain, as described in one embodiment.

[0058] Figure 8 This is a structural block diagram of a trusted fusion device for multi-source data in a software supply chain, as shown in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0061] With the increasing frequency of software supply chain attacks, operators of critical information infrastructure have an increasingly urgent need for continuous assessment of the security status of their suppliers, leading to the emergence of supplier security assessment platform technology. These platforms can access various data sources, including vulnerability scanners, ticketing systems, software bill of materials (SBOM) collection platforms, and supplier reporting portals, and can quantitatively score and display trends for suppliers in areas such as vulnerability remediation and open-source component management.

[0062] However, the aforementioned quantitative scoring and trend display rely on the effective integration of multi-source data. When processing multi-source data, existing technologies typically perform simple field mapping and unit conversion on various data sources, and then directly integrate and use the data from different sources after converting them into structured records.

[0063] However, different data sources have significant differences in field definitions, units of measurement, and time granularity. Simply mapping fields and converting units across various data sources cannot resolve the semantic heterogeneity of the same indicator across different sources. Furthermore, when inconsistencies arise between multiple data sources, there is a lack of a quantitative reliability assessment mechanism to determine which data source to choose. This results in the reliability of the integrated multi-source data being compromised, making it difficult to support subsequent security assessment decisions.

[0064] In view of the above-mentioned technical problems, this application provides a trusted fusion method for multi-source data in the software supply chain. The following embodiments will specifically illustrate the trusted fusion method for multi-source data in the software supply chain.

[0065] The trusted fusion method for multi-source data in the software supply chain provided in this application embodiment can be applied to, for example... Figure 1The computer device shown includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores normalized records and atomic assertions. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a trusted fusion method for multi-source data in a software supply chain.

[0066] Those skilled in the art will understand that Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0067] In one exemplary embodiment, such as Figure 2 As shown, a reliable fusion method for multi-source data in the software supply chain is provided, which can be applied to... Figure 1 Taking computer devices as an example, the explanation includes:

[0068] S201, Acquire multi-source data from the software supply chain.

[0069] The multi-source data includes structured data and textual declarations.

[0070] In this embodiment, the computer device obtains raw data, including structured data and textual declarations, from multiple data sources connected to the software supply chain security assessment platform. The structured data primarily originates from security monitoring tools. For example, the computer device can obtain vulnerability scanning results for software components from various vendors through a vulnerability scanner interface, including vulnerability number, risk level, discovery time, and remediation status; or obtain SBOM files through a software bill of materials (BOM) acquisition platform, which record component names, version numbers, dependencies, and license information; or obtain the processing time, current status, and closure time of vulnerability remediation work orders through a work order system interface; or obtain component access compliance check results through an artifact warehouse policy engine. The structured data obtained by the computer device can be stored in the form of JSON, CSV, or database records.

[0071] For text-based statements, these primarily originate from textual information submitted by suppliers through a reporting portal. For example, suppliers might submit natural language descriptions such as the average remediation time for high-risk vulnerabilities over the past 90 days being less than 24 hours, all components having undergone security testing, and no major security incidents occurring during the security assessment period. Because this text-based statement is in free text format, its field definitions, time granularity, and expression will vary depending on the supplier.

[0072] It is worth noting that the aforementioned multi-source data differ significantly in their acquisition processes, field naming, units of measurement, and time representation. For example, the risk level field output by a vulnerability scanner might be named "risk," while the corresponding field in a support ticket system might be named "severity"; remediation timeframes may be measured in minutes or hours; and time representations may be precise dates or relative times.

[0073] S202 generates normalized records based on structured data, converting textual declarations into atomic assertions.

[0074] In this embodiment, the computer device processes the acquired multi-source data separately. For structured data (such as vulnerability scan results, SBOM manifests, work order records, etc.), the computer device converts it into a standardized record in a unified format through field mapping, unit normalization, time window alignment, and source identifier binding. Each standardized record includes at least a supplier identifier, indicator identifier, observation value, time window information, source type, and source record identifier, which are used for subsequent conflict resolution and credibility assessment.

[0075] For textual statements (such as security self-declarations submitted by suppliers), computer equipment converts them into atomic assertions through candidate sentence screening, restricted structured extraction, and result verification. Each atomic assertion contains at least an indicator identifier, comparison operator, claimed value, time range, and original text location information, which are used for comparison and verification with normalized records.

[0076] S203 resolves conflicts between normalized records and atomic assertions, and then merges the results of conflict resolution to generate a trustworthy dataset.

[0077] Among them, the trusted dataset is used to characterize the trusted results after the fusion of multi-source data.

[0078] In this embodiment, the computer device first groups normalized records and atomic assertions describing the same object into the same comparison group based on supplier identifier, indicator identifier, and time window overlap condition. Then, conflict detection is performed on each comparison group. For comparison groups with conflicts, the fusion result is determined using priority rules or confidence calculations based on the conflict type. For comparison groups without conflicts, the data within the group is directly used as the fusion result. Finally, the fusion results of all comparison groups are aggregated to generate a trusted dataset.

[0079] The aforementioned trusted fusion method for multi-source data in the software supply chain involves acquiring multi-source data from the software supply chain, including structured data and textual claims; generating normalized records from the structured data and converting textual claims into atomic assertions; resolving conflicts between the normalized records and atomic assertions; and fusing the conflict-resolved results to generate a trusted dataset. This trusted dataset represents the trusted result of the multi-source data fusion. This method can uniformly convert structured data and textual claims from different sources and formats into normalized records and atomic assertions, making the multi-source data comparable. Furthermore, through conflict resolution, it can identify and eliminate logical and numerical conflicts between data from different sources, thereby generating a unified trusted dataset. Each record in this trusted dataset has undergone conflict detection and credibility assessment, providing a reliable data source for supply chain security assessment.

[0080] In an exemplary embodiment, the "generating structured data into normalized records" in S202 above, such as Figure 3 As shown, it includes:

[0081] S301, perform field mapping on the structured data to obtain the first structured data.

[0082] In this embodiment, the outputs of tools such as vulnerability scanners, SBOM collectors, and component admission engines are already structured data (e.g., JSON, CSV, or database records), but their formats vary. For example, the vulnerability level field in the vulnerability scanner output is named `risk`, and the risk score field is named `cvss_score`; the corresponding vulnerability level field in the ticket system is named `severity`, and the risk score field is named `risk_score`. Therefore, the computer device needs to perform field mapping through a pre-configured data source adapter to unify these different names to standard field names, such as mapping `risk` and `severity` to `risk_level`, and mapping `cvss_score` and `risk_score` to `risk_value`. After mapping the structured data, the computer device can obtain the first structured data. Optionally, the mapping rules of each data source adapter can be configured independently and managed in a versioned manner.

[0083] S302, perform unit normalization on the first structured data to obtain the second structured data.

[0084] In this embodiment, since different data sources use different units of measurement, the computer device performs unit normalization processing on the first structured data after field mapping. For example, the repair time output by a vulnerability scanner may be in minutes (e.g., 1440 minutes), and the processing time recorded by the work order system may be in days (e.g., 2 days). The computer device converts these different units into standard units, such as converting them into hours, 1440 minutes into 24 hours, and 2 days into 48 hours. After the conversion, the second structured data is obtained.

[0085] S303 performs time window alignment on the second structured data to generate normalized records.

[0086] In this embodiment, due to the inconsistent time representation methods of different data sources, the computer device performs time window alignment processing on the second structured data after unit normalization. For example, the detection time output by the vulnerability scanner may be a precise time point (such as 10:30:00 on March 15, 2025), while the statistical period in the work order system may be expressed as the previous quarter. The computer device unifies these different representations into a standard time window format, for example, classifying the precise time point March 15, 2025 into the 2025-Q1 time window, and classifying the previous quarter into 2025-Q4. After alignment, a normalized record can be generated. In addition, the computer device can also bind source identifiers to the normalized records after time window alignment. Specifically, the source type is marked as TELEMETRY (telemetry data), indicating that the data comes from a security detection tool; at the same time, a source record identifier is recorded, which points to the original data record (such as the unique number of the vulnerability scanning task, the work order number, etc.), so that the original data can be located when needed for subsequent auditing and tracing. After the source identifier is bound, the computer device generates the final normalized record. Each normalized record is recorded using a ten-tuple structure, as shown in Table 1. Those skilled in the art will understand that the field names can be added, removed, or adjusted according to the data model of the actual system, as long as the normalized record contains information that can uniquely identify the source, align the time window, and verify the integrity of the source.

[0087] Table 1

[0088]

[0089] In an exemplary embodiment, the "converting textual declarations into atomic assertions" in S202 above, such as Figure 4 As shown, it includes:

[0090] S401, according to the preset filtering rules, candidate sentences are filtered for the textual declaration to obtain candidate sentences.

[0091] The selection rules include keyword matching and quantitative expression pattern matching.

[0092] In this embodiment, the computer device first acquires a pre-configured indicator dictionary. This indicator dictionary is used to unify the diverse expressions from different suppliers. Each dictionary entry includes at least the following fields: standard indicator identifier, Chinese display name, synonym list, value range, standard unit, and grade mapping table, as shown in Table 2. The Chinese display name and synonym list are used for subsequent keyword matching.

[0093] Table 2

[0094]

[0095] Those skilled in the art will understand that the above dictionary entries can be added or removed based on actual business needs. The `metric_id` is named using English abbreviations, such as `VULN_TAT` (Vulnerability Turnaround Time), `SBOM_COMPLETENESS` (SBOM integrity rate), `COMPONENT_ADMISSION_COMPLIANCE` (component access compliance rate), and `SECURITY_INCIDENT_COUNT` (number of security events), etc. The specific naming is determined by the system administrator during dictionary configuration. The dictionary supports iterative updates: when a certain number of "unidentified assertions" accumulate during system operation, the administrator can identify frequently occurring new metric names and add them to the dictionary.

[0096] Subsequently, the computer equipment retrieves the textual declaration submitted by the supplier and segments it at the sentence level. For each segmented sentence, the following two types of filtering rules are used for selection:

[0097] The first type is keyword matching rules: These rules check whether the sentence contains the Chinese display name of any entry in the indicator dictionary or a keyword from its synonym list. For example, if the sentence contains phrases like "repair timeliness" or "vulnerability repair time," then this keyword matching rule is applied. This keyword matching rule directly relies on the display name and synonyms in the indicator dictionary.

[0098] The second category is quantitative expression pattern matching rules: these rules check whether a sentence contains numbers with units (e.g., 24 hours), comparison operators (e.g., greater than, less than, or not exceeding), percentages (e.g., 95%), or time range descriptions (e.g., the last 90 days or the last quarter). These quantitative expression pattern matching rules are independent of the indicator dictionary and are used to capture sentences containing quantitative information.

[0099] The computer device marks sentences that meet at least one of the filtering rules as candidate sentences, and deletes those that do not meet the rules.

[0100] S402, input the candidate sentences into the natural language model for transformation to obtain the initial atomic assertions.

[0101] In this embodiment, the computer device inputs the selected candidate sentences into a natural language model. The input to the natural language model includes the candidate sentence text, a complete enumeration list of the indicator dictionary, and an operator enumeration set. The model uses a predefined JSON schema, and the output of the natural language model is forced into a fixed JSON structure through syntactic constraint decoding or function call constraints. This structure includes eight fields: `metric_id`, `operator`, `value_or_range`, `unit`, `time_window`, `qualifier`, `text_span`, and `extraction_confidence`. This output constitutes the initial atomic assertion. `metric_id` must be selected from an enumerated list of metrics in the metric dictionary; the natural language model cannot create its own metric names. `operator` must be selected from a predefined set of operators. `time_window` must be normalized to a standard format. If the natural language model cannot map the metric in the candidate sentence to any entry in the dictionary, `metric_id` is output as null, and the assertion is marked as requiring human verification.

[0102] The meanings of the eight fields mentioned above—metric_id, operator, value_or_range, unit, time_window, qualifier, text_span, and extraction_confidence—are as follows: metric_id (metric identifier) ​​is the standard metric code selected from the metric dictionary enumeration list, used to align assertions and structured records to the same metric dimension; operator (comparison operator) is the comparison condition in the vendor's claim, such as less than or not lower than, used for subsequent operator logic condition determination; value_or_range (claimed value or range) is the metric value or value range claimed by the vendor in the text, semantically different from value_or_range (actual observed value) in the normalized record, used for... The subsequent deviation calculation from the actual value; unit (indicator unit) is the unit of measurement involved in the declaration, used for unit normalization; time_window (time range) is the time interval defined in the declaration, used for time window alignment, and marked as an inference time window when missing; qualifier (additional limiting conditions) is a qualitative description of the indicator, such as major in event severity level, high risk in vulnerability type, etc., used to convert it into enumerable structured conditions through the level mapping table; text_span (original text fragment) is the corresponding text of the atomic assertion in the original text, used to trace the text source position of the assertion during auditing; extraction_confidence (extraction confidence) is the self-assessed confidence score of the natural language model for this extraction result, reflecting the model's certainty about the slot filling result, used for subsequent confidence verification.

[0103] For example, for a supplier's statement that no major security incidents have occurred in the past six months, the output of the natural language model is: metric_id is SECURITY_INCIDENT_COUNT, operator is "=", value_or_range is 0, time_window is "last 180 days", qualifier is "major", text_span is "no major security incidents have occurred in the past six months", and extraction_confidence is 0.91. This result is the initial atomic assertion. The qualifier field "major" will subsequently be converted to "event level" through a level mapping table. "Structured conditions".

[0104] S403 verifies the result of the initial atomic assertion and generates an atomic assertion.

[0105] The result verification includes format verification, value range verification, and confidence level verification.

[0106] In this embodiment, the computer device performs three layers of deterministic verification on the initial atomic assertion. The first layer is format verification, which checks whether the required fields of the initial atomic assertion are not empty, whether the metric_id exists in the indicator dictionary, and whether the operator is within the predefined allowed set. If the metric_id is null, the assertion is marked as an "unrecognized assertion" and stored in the queue for manual confirmation, without proceeding to the next step. The second layer is value range verification, which checks whether the value_or_range is within the value_domain defined in the indicator dictionary entry. For example, the value of a percentage-type indicator should not exceed 100%, and the value of a repair timeliness indicator should not be negative. If it exceeds a reasonable value range, the verification fails. The third layer is confidence verification, which checks whether extraction_confidence is lower than a preset threshold. The preset threshold is preferably between 0.7 and 0.9. If the confidence is lower than the threshold, the initial atomic assertion is marked as a low-confidence assertion and sent to the manual review channel. When all three layers of verification pass, the initial atomic assertion is marked as an atomic assertion and proceeds to the next step; otherwise, it is handled accordingly based on the type of verification failure (pending manual confirmation or manual review) and does not proceed to the next processing flow.

[0107] In an exemplary embodiment, the above-mentioned S203, "resolving conflicts between normalized records and atomic assertions, and fusing the conflict-resolved results to generate a reliable dataset," is as follows: Figure 5 As shown, it includes:

[0108] S501 groups normalized records and atomic assertions with the same supplier identifier, the same indicator identifier and overlapping time windows into the same group, resulting in multiple comparison groups.

[0109] In this embodiment, after obtaining multiple normalized records and atomic assertions, the computer device groups these two types of data to perform conflict detection and credibility assessment within the same dimension. Specifically, the computer device groups normalized records and atomic assertions according to the following three conditions: First, the vendor identifiers are the same. That is, all data within the comparison group must come from the same vendor, which can be matched based on the vendor_id field. Second, the metric identifiers are the same. That is, all data within the comparison group must describe the same security metric, which can be matched based on the metric_id field. For example, VULN_TAT (timeliness of high-risk vulnerability remediation) and SBOM_COMPLETENESS (SBOM integrity rate) are different metrics and cannot be grouped together. Third, the time windows overlap. That is, the observation_window in the normalized record and the time_window in the atomic assertion must intersect. For example, if the time window of an atomic assertion is nearly 90 days, including January to March 2025, and the time window of a normalized record is the first quarter of 2025, and the time windows of the atomic assertion and the normalized record overlap, then they will be grouped into the same comparison group; if the time windows are the first quarter of 2025 and the fourth quarter of 2025 respectively, and there is no overlap, then they will be grouped into different comparison groups.

[0110] Normalized records and atomic assertions that meet the above three conditions are grouped into the same comparison group. After the computer device performs the above grouping operation on all normalized records and atomic assertions, it can obtain multiple independent comparison groups. Each comparison group contains multiple normalized records and multiple atomic assertions, or a combination of both.

[0111] S502 performs conflict detection on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results.

[0112] In this embodiment, the computer device traverses each comparison group and performs conflict detection on the normalized records and atomic assertions within the comparison group. Specifically, conflict detection includes two aspects: operator logic judgment and numerical deviation judgment. The computer device first determines whether the actual observed value in the normalized record meets the comparison conditions in the atomic assertion. If it does not meet the conditions, it is directly marked as a logical conflict; if it does meet the conditions, it further calculates the deviation between the actual observed value and the claimed value, and compares the deviation with a preset threshold corresponding to the index. Based on the comparison result, it is marked as a numerical conflict or no conflict. After the detection is completed, each comparison group can obtain a conflict detection result.

[0113] S503: When there is a conflict within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation.

[0114] In this embodiment, if a conflict exists within a comparison group, the computer device needs to select the appropriate processing method based on the conflict type to determine the fusion result of the comparison group. Specifically, if the conflict occurs between multiple normalized records or multiple atomic assertions (i.e., between multiple data of the same source type, such as two different TELEMETRY sources), the fusion result is determined according to a preset priority rule. The priority rule is as follows: the record with the highest data freshness S_fresh is selected first; if the freshness is the same, the record that passes the source integrity signature_status verification is selected first; if it is still impossible to distinguish, the comparison group is marked as pending manual confirmation. For example, vendor D's SBOM integrity rate index has data from three sources: data source 1 (vulnerability scanner) has a record value of 92%, data source 2 (another detection tool) has a record value of 78%, and data source 3 (vendor declaration) has a record value of 99%. Among them, data source 1 and data source 2 are both TELEMETRY (telemetry) type, and the basic credibility of the source type is the same. The computer equipment first compares the data timeliness (S_fresh) of data source 1 and data source 2. If the collection time of data source 1 is more up-to-date, then 92% of the data from data source 1 is selected as the representative value. If the data timeliness of data source 1 and data source 2 is the same, then the source integrity status is further compared, and records with valid signature verification (signature_status=valid) are selected. If they still cannot be distinguished, the indicator is marked as "inconsistent within the same source, pending manual confirmation." After determining the trustworthy value on the TELEMETRY side, cross-type conflict detection and resolution are then performed with data source 3 (text-type data, such as supplier declarations).

[0115] If a conflict occurs between normalized records and atomic assertions (i.e., between data from different sources, such as normalized records from TELEMETRY and atomic assertions from TEXT giving different values ​​for the same metric), then the confidence scores of normalized records and atomic assertions are calculated separately, and the one with the highest score is selected as the fusion result for that comparison group.

[0116] Preferably, the source credibility score is calculated in the following form:

[0117] ,in, .

[0118] Wherein: W_base represents the basic credibility of the source type, used to reflect the inherent reliability differences of different acquisition links. Automated detection tools extract data directly from the scanning engine and work order system, with fewer intermediate links, resulting in high basic credibility (preferred value 0.80-0.90); texts filled in by suppliers themselves naturally have subjective embellishment motives, resulting in low basic credibility (preferred value 0.30-0.45).

[0119] S_sig represents the source integrity score, used to reflect whether the data has been tampered with during the transmission link. If the data packet is accompanied by a digital signature and the signature verification passes, it means that the link from the collection point to the platform is intact, and S_sig = 1.0; otherwise, it is reduced according to the verification result.

[0120] S_fresh represents the data timeliness score, reflecting that the security status is dynamically changing; the test results from three months ago are less representative of the current status than the test results from last week. Preferably, it is calculated using a time decay function, such as S_fresh = exp( ),in This is the difference between the data collection time and the current time. The attenuation coefficient is preferred (0.01-0.05 / day).

[0121] H_conf represents the historical conflict rate. Preferably, within a rolling M-day window, H_conf = N_conflict / N_comparable, excluding the current batch to be resolved. Here, N_comparable is the number of records from this source that can be compared with at least one other source under the conditions of the same supplier, the same metric, and overlapping time windows.

[0122] N_conflict represents the number of records identified as having logical or numerical conflicts. The historical conflict rate is used as negative feedback; specifically, if a source frequently conflicts with other sources over a period of time, it indicates a potential systemic problem with the data quality of that source, and it should be downweighted. To avoid fluctuations caused by insufficient samples, preferably, when N_comparable is less than the minimum sample threshold N_min, weighting based on H_conf is not enabled, or H_conf is set to a preset default value. The formula uses (1-H_conf) instead of directly using H_conf because the confidence score should be negatively correlated with the conflict rate.

[0123] Basis for selecting weight parameters: The preferred value is 0.40-0.55, because the inherent differences in the source type are the most significant factor affecting data reliability; The preferred value is 0.15-0.25, because source integrity is a hard check, which is important but in most cases the result is binary (pass or fail). The preferred value is 0.10-0.20; The optimal value is 0.10-0.20, because the historical conflict rate signal needs to accumulate enough samples to stabilize, and the weight should not be too high. After conflict resolution, the source credibility score C of the selected credible record is written as the credibility_score field into the normalized structure R of that record.

[0124] S504, when there are no conflicts within the comparison group, determine the normalized record and atomic assertion of the comparison group as the fusion result of the comparison group.

[0125] In this embodiment, when there are no conflicts within a comparison group, it indicates that all data within the comparison group are consistent, and there is no need to calculate confidence scores or select priorities. The computer device can directly use the normalized records or atomic assertions within the comparison group as the fusion result. Since there are no conflicts, regardless of whether there is one or more data records in the comparison group, the information they express is consistent, and any one of them can represent the fusion result of the comparison group. The computer device can use the first record or any one of all records in the comparison group as the representative.

[0126] S505 summarizes the fusion results of each comparison group to generate a reliable dataset.

[0127] In this embodiment, each comparison group corresponds to a fusion result. For comparison groups without conflicts, the fusion result is the normalized record or atomic assertion within the group; for comparison groups with conflicts, the fusion result is the best record selected through priority rules or confidence calculation. After all comparison groups have been processed, the computer device outputs the aggregated set of data records as a trusted dataset, wherein each data record in the trusted dataset has undergone conflict resolution and confidence evaluation.

[0128] It is worth noting that there are two boundary cases in the process of computer equipment processing data: The first case is the absence of a time window for an atomic assertion. When the time range is not declared in the atomic assertion, the computer equipment can assign the observation window of the normalized record corresponding to the atomic assertion as the alignment benchmark to the assertion and mark the time window as the inference time window to ensure that the atomic assertion can participate in grouping and comparison. For example, vendor A declares that "all high-risk vulnerabilities will be fixed within 48 hours" but does not specify a specific time range. The atomic assertion extracted by the computer equipment is: {metric_id: VULN_TAT, operator: <=, value_or_range: 48, unit: h, time_window: null, qualifier: null, text_span: "all high-risk vulnerabilities will be fixed within 48 hours", extraction_confidence: 0.87}, where the time_window field is null. When entering the group comparison, the computer device compares the atomic assertion with the normalized record with an observation window of nearly 90 days, and uses the nearly 90 days as the time window alignment benchmark for the atomic assertion. At the same time, it marks time_window_inferred=true, indicating that the time window is an inferred value and not the information in the original supplier statement.

[0129] The second scenario involves an indicator that exists only as a textual declaration without any objective test data. When an atomic assertion lacks a corresponding normalized record for comparison, the computer converts the atomic assertion into a normalized record with a source type of unverified text (source_type=TEXT_UNVERIFIED) and adds it to the trusted dataset. Because this record lacks a cross-validation source, its confidence score is significantly lower than that of a normal record that has undergone conflict resolution and cross-validation. The computer's handling of these two edge cases ensures that the trusted dataset generates complete fusion results in all situations, avoiding information omissions due to missing data or incomplete formatting.

[0130] In an exemplary embodiment, the above-mentioned S502, "performing conflict detection on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results," is as follows: Figure 6 As shown, it includes:

[0131] S601 performs operator logic judgment on the normalized records and atomic assertions within the comparison group to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0132] In this embodiment, the computer device first performs operator logic determination on the atomic assertions and normalized records within the comparison group. This determination is deterministic logic and does not involve any threshold configuration. Specifically, the computer device checks whether the actual observed values ​​in the normalized records satisfy the comparison conditions declared in the atomic assertions (such as greater than, less than, equal to, etc.).

[0133] S602, when the actual observed value does not meet the comparison conditions with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection.

[0134] In this embodiment of the application, if the logical determination result of the operator is that the actual observed value and the claimed value do not meet the comparison condition, the computer device marks the conflict between the atomic assertion and the normalized record as a logical conflict.

[0135] For example, Supplier A declares that "component access compliance rate is no less than 95%". The computer device extracts the atomic assertion {metric_id: COMPONENT_ADMISSION_COMPLIANCE, operator: >=, value_or_range: 95, unit: %, time_window: null, qualifier: null, text_span: "component access compliance rate is no less than 95%", extraction_confidence: 0.89}. However, the vulnerability scanner's actual detection value is only 93.1%. The computer device determines whether 93.1% meets the requirement of ≥95%, concluding that it does not. Therefore, it directly marks the assertion as a logical conflict and does not proceed to subsequent numerical deviation calculations.

[0136] It should be noted that logical conflicts differ from ordinary numerical deviations. If only numerical deviations are calculated, such as... If the value is far below the standard conflict threshold (e.g., 20%~40%), it is very likely to be misjudged as non-conflictible. However, operator logic can accurately identify situations where the boundary conditions of the supplier's commitments are violated, avoiding omissions.

[0137] S603, when the actual observed value and the claimed value meet the comparison conditions, calculate the deviation between the actual observed value and the claimed value.

[0138] In this embodiment, when the operator logic determines that the actual observed value meets the comparison condition of the atomic assertion, the computer device further calculates the deviation between the actual observed value and the claimed value. The deviation calculation formula is: D = |v_actual - v_claimed| / max(|v_claimed|, ε), where v_actual is the actual observed value, v_claimed is the claimed value in the atomic assertion, and ε is a very small positive number used to prevent the denominator from being zero. This formula converts the absolute deviation into a relative deviation, which is convenient for subsequent comparison with the threshold. For example, supplier A declares "repair time not exceeding 48 hours", and the actual detection value is 41.3 hours. The operator determines that 41.3 ≤ 48 is true, meeting the comparison condition, and the computer device further calculates the deviation D = |41.3 - 48| / 48 ≈ 14.0%. This deviation value will be used for comparison with the preset threshold in subsequent steps.

[0139] S604 When the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection.

[0140] The preset threshold is determined by the indicator identifier in the atomic assertion.

[0141] In this embodiment, the computer device compares the calculated deviation D with the conflict threshold corresponding to the indicator. The conflict threshold is pre-configured according to the indicator type; different indicators can have different thresholds, with a preferred value of 20%-40%, which can be adjusted according to actual business needs. For example, supplier A declares that "the time for repairing high-risk vulnerabilities will not exceed 100 hours" (i.e., the comparison condition is ≤100), while the actual detection value is 68 hours; logically, 68≤100 is true. If the preset threshold is 30%, and the calculated deviation D is 32%, exceeding 30%, then a numerical conflict is determined.

[0142] S605, when the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of the conflict detection.

[0143] In this embodiment, if the deviation D calculated by the computer device does not exceed the preset threshold corresponding to the indicator, the computer device determines that there is no conflict between the atomic assertion and the normalized record, and takes the absence of conflict as the result of conflict detection. At this time, the atomic assertion and the normalized record are considered consistent and can be used directly. For example, if the supplier declares that "the time limit for repairing high-risk vulnerabilities does not exceed 100 hours", and the actual detection value is 95 hours, the logical judgment that 95≤100 is true, the deviation D=5%, which does not exceed the preset threshold of 30%, is therefore determined to be conflict-free.

[0144] In summary, based on all the above embodiments, a reliable fusion method for multi-source data in the software supply chain is also provided, such as... Figure 7As shown, the method includes:

[0145] S701, obtain structured data and textual declarations from the software supply chain; execute S702-S704 to process the structured data; execute S705-S707 to process the textual declarations.

[0146] S702, perform field mapping on the structured data to obtain the first structured data;

[0147] S703, perform unit normalization on the first structured data to obtain the second structured data;

[0148] S704 performs time window alignment on the second structured data to generate normalized records;

[0149] S705, according to the preset filtering rules, candidate sentences are filtered for the textual declaration to obtain candidate sentences;

[0150] S706, input the candidate sentences into the natural language model for transformation to obtain the initial atomic assertions;

[0151] S707 verifies the result of the initial atomic assertion and generates an atomic assertion;

[0152] S708 groups normalized records and atomic assertions with the same supplier identifier, the same indicator identifier and overlapping time windows into the same group, resulting in multiple comparison groups.

[0153] S709 executes S710-S714 to perform conflict detection on the normalized records and atomic assertions in each comparison group and obtains the conflict detection results.

[0154] S710: Perform operator logic judgment on the normalized record and atomic assertion in the comparison group to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison condition in the atomic assertion. If the actual observed value and the claimed value do not meet the comparison condition, execute S711; if the actual observed value and the claimed value meet the comparison condition, execute S712-S714.

[0155] S711, when the actual observed value does not meet the comparison conditions with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection;

[0156] S712, when the actual observed value and the claimed value meet the comparison conditions, calculate the deviation between the actual observed value and the claimed value. If the deviation exceeds the preset threshold, execute S713; if the deviation does not exceed the preset threshold, execute S714.

[0157] S713, when the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection;

[0158] S714, when the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of the conflict detection;

[0159] S715: If there is a conflict within the comparison group, execute S716-S717; if there is no conflict within the comparison group, execute S718.

[0160] S716, If a conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on the preset priority rules;

[0161] S717, If a conflict occurs between normalized records and atomic assertions, calculate the confidence of normalized records and atomic assertions respectively, and determine the one with the highest confidence as the fusion result of the comparison group;

[0162] S718, when there are no conflicts within the comparison group, determine the normalized record and atomic assertion of the comparison group as the fusion result of the comparison group;

[0163] S719 summarizes the fusion results of each comparison group to generate a reliable dataset.

[0164] The methods described in each of the above steps have been described in the foregoing embodiments. For details, please refer to the foregoing descriptions. They will not be repeated here.

[0165] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0166] The above embodiments are explained and illustrated by some examples below, which do not limit the technical solution.

[0167] In an exemplary application scenario, taking Supplier A as an example, the computer equipment receives five types of input within the same evaluation cycle: ① Timeliness data on high-risk vulnerability remediation generated by the vulnerability scanner and remediation work order system; ② SBOM integrity rate data generated by the SBOM collection platform; ③ Component access compliance rate data generated by the component access policy engine; ④ Quarterly security statement texts submitted by the supplier; ⑤ Security incident data such as records of changes in key security positions. Each type of input includes a supplier identifier, collection time or observation time window, and source record identifier.

[0168] First, the computer equipment processes the five types of input separately. Specifically, for the first three types of structured telemetry data (①②③), the computer equipment performs field mapping, unit normalization, and time window alignment through a data source adapter to obtain normalized records (e.g., vulnerability remediation timeliness is uniformly converted to hours based on a 90-day window, and SBOM integrity rate and component access compliance rate are uniformly converted to percentages); for the fifth type of security event data (critical security position change records), the computer equipment also converts it into normalized records through an adapter (metric_id=PERSONNEL_CHANGE_COUNT, value_or_range=1, unit=times, source_type=EVENT); the computer equipment processes the first three types of input separately. ④ Textualized security statements undergo a three-stage atomic assertion extraction process: After candidate sentence screening, sentences such as "the average repair time for high-risk vulnerabilities in the past 90 days does not exceed 24 hours," "the component access compliance rate is not less than 95%," and "no major security incidents have occurred this quarter" are subject to restricted structured extraction, and the corresponding eight-field JSON (including metric_id, operator, value_or_range, unit, time_window, qualifier, text_span, extraction_confidence) is output. After the extraction results undergo three layers of verification, the atomic assertions enter the subsequent conflict resolution process.

[0169] Subsequently, the computer equipment was grouped and compared according to "supplier + indicator + overlapping time window". For the assertion that "component access compliance rate is not less than 95%" (operator: >=, value_or_range: 95), objective testing records showed that the actual value for the same time window was 93.1%. The computer equipment first executed the operator logic condition judgment: 93.1% >= 95% is false, directly determining it as a logical conflict. Regarding the high-risk vulnerability remediation timeframe, the supplier's text statement was "no more than 24 hours" (operator: <=, value_or_range: 24), while the scan and work order fusion result was 68.2 hours. The logical condition 68.2 <= 24 is false, also determining it as a logical conflict. For the assertion "No major security incidents occurred this quarter" (operator ""=value_or_range: 0, qualifier: major), the computer device transforms "major" into "event level ∈ {P0, P1}" using a level mapping table. Then, it constructs an existence query to retrieve security event records at levels P0 / P1 within this time window. The result is zero records, the logical condition 0=0 is satisfied, and there is no numerical deviation. Therefore, this atomic assertion is conflict-free, and the corresponding objective detection (security event count = 0) is directly written to the trusted dataset. For the SBOM completeness rate, the objective detection data is the only source and there are no conflicting textual claims. The computer device directly writes the corresponding normalized record to the trusted dataset without triggering a resolution decision. For two conflicting metrics, the computer device... Calculate the credibility score for each source, and preferentially retain records from the automated detection link that have passed the signature verification and have been collected more recently to form a credible dataset. The text statement is retained as conflict evidence and written into the resolution log.

[0170] Based on the same inventive concept, this application also provides a trusted fusion device for multi-source data in the software supply chain, used to implement the trusted fusion method for multi-source data in the software supply chain described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the trusted fusion device for multi-source data in the software supply chain provided below can be found in the limitations of the trusted fusion method for multi-source data in the software supply chain described above, and will not be repeated here.

[0171] In one exemplary embodiment, such as Figure 8 As shown, a trusted fusion device for multi-source data in a software supply chain is provided, comprising:

[0172] Module 11 is used to acquire multi-source data from the software supply chain, including structured data and textual declarations.

[0173] Transformation module 12 is used to generate normalized records based on structured data and convert textual declarations into atomic assertions;

[0174] The conflict resolution module 13 is used to resolve conflicts between normalized records and atomic assertions, and to fuse the conflict resolution results to generate a trusted dataset. The trusted dataset is used to characterize the trusted results after the fusion of multi-source data.

[0175] In one embodiment, the conversion module 12 includes:

[0176] The first transformation unit is used to map fields of structured data to obtain the first structured data;

[0177] The second conversion unit is used to perform unit normalization processing on the first structured data to obtain the second structured data;

[0178] The third transformation unit is used to perform time window alignment processing on the second structured data to generate normalized records.

[0179] In one embodiment, the conversion module 12 further includes:

[0180] The fourth conversion unit is used to filter candidate sentences from the textual declaration according to preset filtering rules to obtain candidate sentences. The filtering rules include keyword matching and quantitative expression pattern matching.

[0181] The fifth transformation unit is used to input candidate sentences into the natural language model for transformation, and obtain initial atomic assertions;

[0182] The sixth transformation unit is used to perform result verification on the initial atomic assertion and generate atomic assertions. The result verification includes format verification, value range verification and confidence level verification.

[0183] In one embodiment, the above-mentioned resolution module 13 includes:

[0184] Overlapping units are used to group normalized records and atomic assertions with the same supplier identifier, the same indicator identifier and overlapping time windows into the same group to obtain multiple comparison groups.

[0185] The detection unit is used to perform conflict detection on the normalized records and atomic assertions in each comparison group and obtain the conflict detection results.

[0186] The existence unit is used to determine the fusion result of the comparison group according to the preset priority rules and confidence calculation when there is a conflict within the comparison group;

[0187] The determination unit is used to determine the normalized record and atomic assertion of the comparison group as the fusion result of the comparison group when there is no conflict within the comparison group;

[0188] The generation unit is used to summarize the fusion results of each comparison group and generate a reliable dataset.

[0189] In one embodiment, the detection unit includes:

[0190] The first detection subunit is used to perform operator logic judgment on the normalized records and atomic assertions in the comparison group to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0191] The second detection subunit is used to determine a logical conflict when the actual observed value does not meet the comparison conditions with the claimed value, and to take the logical conflict as the result of the conflict detection.

[0192] The third detection subunit is used to calculate the deviation between the actual observed value and the claimed value when the actual observed value and the claimed value meet the comparison conditions.

[0193] The fourth detection subunit is used to determine a numerical conflict when the deviation exceeds a preset threshold, and to take the numerical conflict as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion.

[0194] The fifth detection subunit is used to determine that there is no conflict when the deviation does not exceed the preset threshold, and to take the lack of conflict as the result of conflict detection.

[0195] In one embodiment, the aforementioned existing unit includes:

[0196] The first existence subunit is used to determine the fusion result of the comparison group based on a preset priority rule if a conflict occurs between multiple normalized records or multiple atomic assertions.

[0197] The second existence subunit is used to calculate the confidence level of the normalized record and the atomic assertion respectively if a conflict occurs between them, and to determine the fusion result of the comparison group with the highest confidence level.

[0198] Each module in the aforementioned trusted fusion device for multi-source data in the software supply chain can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0199] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0200] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0201] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0202] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0203] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0204] The structured data is mapped to its fields to obtain the first structured data.

[0205] The first structured data is normalized to obtain the second structured data;

[0206] The second structured data is aligned using time windows to generate normalized records.

[0207] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0208] Candidate sentences are selected from the textual declaration according to the preset filtering rules. The filtering rules include keyword matching and quantitative expression pattern matching.

[0209] The candidate sentences are input into a natural language model for transformation to obtain the initial atomic assertions;

[0210] The initial atomic assertion is validated to generate the atomic assertion. The validation includes format validation, range validation and confidence validation.

[0211] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0212] Normalized records with the same supplier identifier, the same indicator identifier, and overlapping time windows are grouped together with atomic assertions to obtain multiple comparison groups.

[0213] Conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results;

[0214] When there are conflicts within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation.

[0215] When there are no conflicts within the comparison group, the normalized record and atomic assertion of the comparison group are determined as the fusion result of the comparison group.

[0216] The fusion results of each comparison group are summarized to generate a reliable dataset.

[0217] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0218] Operator logic is used to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0219] When the actual observed value does not meet the comparison criteria with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection.

[0220] When the actual observed value and the claimed value meet the comparison criteria, calculate the deviation between the actual observed value and the claimed value;

[0221] When the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion.

[0222] When the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of conflict detection.

[0223] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0224] If a conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on a preset priority rule;

[0225] If a conflict occurs between normalized records and atomic assertions, the confidence levels of the normalized records and atomic assertions are calculated separately, and the one with the highest confidence level is selected as the fusion result of the comparison group.

[0226] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0227] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0228] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0229] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0230] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0231] The structured data is mapped to its fields to obtain the first structured data.

[0232] The first structured data is normalized to obtain the second structured data;

[0233] The second structured data is aligned using time windows to generate normalized records.

[0234] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0235] Candidate sentences are selected from the textual declaration according to the preset filtering rules. The filtering rules include keyword matching and quantitative expression pattern matching.

[0236] The candidate sentences are input into a natural language model for transformation to obtain the initial atomic assertions;

[0237] The initial atomic assertion is validated to generate the atomic assertion. The validation includes format validation, range validation and confidence validation.

[0238] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0239] Normalized records with the same supplier identifier, the same indicator identifier, and overlapping time windows are grouped together with atomic assertions to obtain multiple comparison groups.

[0240] Conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results;

[0241] When there are conflicts within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation.

[0242] When there are no conflicts within the comparison group, the normalized record and atomic assertion of the comparison group are determined as the fusion result of the comparison group.

[0243] The fusion results of each comparison group are summarized to generate a reliable dataset.

[0244] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0245] Operator logic is used to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0246] When the actual observed value does not meet the comparison criteria with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection.

[0247] When the actual observed value and the claimed value meet the comparison criteria, calculate the deviation between the actual observed value and the claimed value;

[0248] When the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion.

[0249] When the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of conflict detection.

[0250] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0251] If a conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on a preset priority rule;

[0252] If a conflict occurs between normalized records and atomic assertions, the confidence levels of the normalized records and atomic assertions are calculated separately, and the one with the highest confidence level is selected as the fusion result of the comparison group.

[0253] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0254] Acquire multi-source data from the software supply chain, including structured data and textual claims;

[0255] Generate normalized records from structured data and convert textual declarations into atomic assertions;

[0256] The normalized records and atomic assertions are conflict-resolved, and the conflict-resolved results are merged to generate a trusted dataset, which is used to characterize the trusted results after the fusion of multi-source data.

[0257] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0258] The structured data is mapped to its fields to obtain the first structured data.

[0259] The first structured data is normalized to obtain the second structured data;

[0260] The second structured data is aligned using time windows to generate normalized records.

[0261] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0262] Candidate sentences are selected from the textual declaration according to the preset filtering rules. The filtering rules include keyword matching and quantitative expression pattern matching.

[0263] The candidate sentences are input into a natural language model for transformation to obtain the initial atomic assertions;

[0264] The initial atomic assertion is validated to generate the atomic assertion. The validation includes format validation, range validation and confidence validation.

[0265] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0266] Normalized records with the same supplier identifier, the same indicator identifier, and overlapping time windows are grouped together with atomic assertions to obtain multiple comparison groups.

[0267] Conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results;

[0268] When there are conflicts within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation.

[0269] When there are no conflicts within the comparison group, the normalized record and atomic assertion of the comparison group are determined as the fusion result of the comparison group.

[0270] The fusion results of each comparison group are summarized to generate a reliable dataset.

[0271] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0272] Operator logic is used to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion.

[0273] When the actual observed value does not meet the comparison criteria with the claimed value, it is determined to be a logical conflict, and the logical conflict is taken as the result of the conflict detection.

[0274] When the actual observed value and the claimed value meet the comparison criteria, calculate the deviation between the actual observed value and the claimed value;

[0275] When the deviation exceeds the preset threshold, it is determined to be a numerical conflict, and the numerical conflict is taken as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion.

[0276] When the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of conflict detection.

[0277] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0278] If a conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on a preset priority rule;

[0279] If a conflict occurs between normalized records and atomic assertions, the confidence levels of the normalized records and atomic assertions are calculated separately, and the one with the highest confidence level is selected as the fusion result of the comparison group.

[0280] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0281] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0282] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A reliable fusion method for multi-source data in a software supply chain, characterized in that, The method includes: Acquire multi-source data from the software supply chain, including structured data and textual claims; Generate normalized records based on the structured data, and convert the textual declarations into atomic assertions; The normalized record and the atomic assertion are conflict-resolved, and the conflict-resolved results are fused to generate a trusted dataset, which is used to characterize the trusted result after the fusion of the multi-source data.

2. The method according to claim 1, characterized in that, The step of generating normalized records from the structured data includes: The structured data is mapped to fields to obtain the first structured data; The first structured data is normalized to obtain the second structured data; The second structured data is subjected to time window alignment processing to generate the normalized record.

3. The method according to claim 1, characterized in that, The step of converting the textualized declaration into an atomic assertion includes: The textual declaration is filtered for candidate sentences according to preset filtering rules to obtain candidate sentences. The filtering rules include keyword matching and quantitative expression pattern matching. The candidate sentences are input into a natural language model for conversion to obtain initial atomic assertions; The initial atomic assertion is validated to generate the atomic assertion. The validation includes format validation, range validation, and confidence level validation.

4. The method according to claim 1, characterized in that, The step of resolving conflicts between the normalized record and the atomic assertion, and then fusing the conflict-resolved results to generate a trusted dataset, includes: Normalized records with the same supplier identifier, the same indicator identifier, and overlapping time windows are grouped together with atomic assertions to obtain multiple comparison groups. Conflict detection is performed on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results; When there is a conflict within the comparison group, the fusion result of the comparison group is determined according to the preset priority rules and confidence calculation. When there are no conflicts within the comparison group, the normalized record and atomic assertion of the comparison group are determined as the fusion result of the comparison group. The fusion results of each comparison group are summarized to generate the trusted dataset.

5. The method according to claim 4, characterized in that, The step of performing conflict detection on the normalized records and atomic assertions within each comparison group to obtain the conflict detection results includes: Operator logic is performed on the normalized records and atomic assertions within the comparison group to determine whether the actual observed value of the normalized record and the claimed value in the atomic assertion meet the comparison conditions in the atomic assertion; When the actual observed value does not meet the comparison condition with the claimed value, it is determined to be a logical conflict, and the logical conflict is used as the result of the conflict detection. When the actual observed value and the claimed value meet the comparison conditions, the deviation between the actual observed value and the claimed value is calculated; When the deviation exceeds a preset threshold, it is determined to be a numerical conflict, and the numerical conflict is used as the result of the conflict detection. The preset threshold is determined by the indicator in the atomic assertion. When the deviation does not exceed the preset threshold, it is determined to be conflict-free, and the conflict-free result is taken as the result of the conflict detection.

6. The method according to claim 4, characterized in that, When conflicts exist within the comparison group, the fusion result of the comparison group is determined according to preset priority rules and confidence calculations, including: If the conflict occurs between multiple normalized records or multiple atomic assertions, the fusion result of the comparison group is determined based on the preset priority rule; If the conflict occurs between normalized records and atomic assertions, the confidence levels of the normalized records and atomic assertions are calculated respectively, and the one with the highest confidence level is determined as the fusion result of the comparison group.

7. A trusted fusion device for multi-source data in a software supply chain, characterized in that, The device includes: The acquisition module is used to acquire multi-source data from the software supply chain, including structured data and textual declarations. The conversion module is used to generate normalized records based on the structured data and convert the textual declarations into atomic assertions; The conflict resolution module is used to resolve the conflict between the normalized record and the atomic assertion, and to fuse the conflict resolution results to generate a trusted dataset, which is used to characterize the trusted result after the fusion of the multi-source data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images