Multi-agent collaborative arrangement method and system based on software supply chain security detection

Abstract

The present application relates to the technical field of computer software security, and specifically discloses a multi-agent collaborative arrangement method and system based on software supply chain security detection, wherein a task disintegration and stage arrangement engine is constructed to organize multiple special security detection agents such as SCA agents, code audit agents and license detection agents into a directed acyclic graph type detection pipeline; a task state machine is used to manage the life cycle state of each detection node, and asynchronous queues are used to realize decoupled communication between agents; the scanning results of upstream agents are used as the task input and strategy parameters of downstream agents to realize result-driven dynamic arrangement; and a failure node compensation mechanism is used to automatically retry or degrade and replace abnormal detection nodes to ensure the integrity of the overall detection task and improve the reliability and integrity of software supply chain security detection.

Description

Technical Field

[0001] This invention relates to the field of computer software security technology, and more specifically, to a multi-agent collaborative orchestration method and system based on software supply chain security detection. Background Technology

[0002] Software supply chain security has become a significant threat in the cybersecurity field. While existing software supply chain security testing platforms can integrate multiple security testing tools, these tools mostly operate as independent units, typically employing fixed workflows or simple serial / parallel execution methods. There is a lack of a unified collaborative orchestration mechanism between these tools, hindering the establishment of a complete testing process control system. Furthermore, the test results generated by upstream testing tools are usually only used as the final report output and cannot serve as input for subsequent testing stages. This results in subsequent testing continuing to follow fixed rules, failing to dynamically adjust the testing scope, rules, and resource allocation for high-risk targets. Consequently, a large amount of computing resources is consumed in low-risk areas, limiting both testing efficiency and accuracy.

[0003] On the other hand, because software supply chain security testing involves software component analysis tools, code auditing tools, and license testing tools, which typically use different development languages, operating environments, and deployment methods, there is significant heterogeneity among these tools. Traditional solutions often use tightly coupled interfaces for integration, resulting in poor tool scalability. Adding new testing capabilities often requires modifying the entire testing process, making it difficult to meet the needs of continuous expansion and flexible upgrades for software supply chain security testing platforms. Furthermore, in actual testing processes, due to network anomalies, insufficient resources, rule adaptation failures, and other reasons, some testing nodes are prone to execution failures or timeouts. Existing technologies typically only use simple retries or direct termination of the testing task, lacking differentiated compensation mechanisms for different failure causes. When a local testing node experiences anomalies, it can easily lead to the interruption of the entire testing process or the loss of testing results, affecting the integrity and reliability of software supply chain security testing results.

[0004] Therefore, it is necessary to provide a multi-agent collaborative orchestration method and system based on software supply chain security detection to solve the above-mentioned technical problems. In order to solve the above problems, a technical solution is provided. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of existing technologies, this invention provides a multi-agent collaborative orchestration method and system based on software supply chain security detection. This system addresses the problems in existing software supply chain security detection systems, such as multiple specialized security detection agents operating in isolation, lack of a phased orchestration mechanism based on task state machines, inability of upstream scanning results to drive dynamic adjustments to downstream detection strategies, and lack of compensation capabilities when local nodes fail, resulting in insufficient accuracy and reliability of multi-scanner collaborative detection.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A multi-agent collaborative orchestration method based on software supply chain security detection includes the following steps: By receiving software supply chain security testing requests and basic information about the products to be tested, a security testing task is constructed, and the security testing task is broken down into corresponding security testing sub-tasks according to several testing dimensions. A DAG-based detection pipeline is constructed based on the data dependencies between security detection subtasks, and a task state machine is used to manage the lifecycle state of the detection nodes corresponding to each security detection subtask. By scheduling multiple security detection agents to execute corresponding security detection subtasks, each security detection agent communicates decoupledly through an asynchronous message queue and outputs the detection results to the result-driven orchestration engine. The result-driven orchestration engine parses the detection results output by the upstream security detection agent, generates the detection strategy parameters of the downstream security detection agent based on the detection results, and drives the downstream security detection agent to perform detection according to the detection strategy parameters. During the detection process, the status of each detection node is updated in real time using the task state machine. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality. Automatic compensation processing is performed on the abnormal node, and the subsequent detection process continues after the compensation is completed. A software supply chain security testing report is generated by aggregating the testing results from various security testing agents.

[0007] As a further aspect of the present invention, the task state machine includes an initialization state, a queuing state, an execution state, an execution success state, an execution failure state, and a compensated state.

[0008] As a further aspect of the present invention, the security detection agent includes an SCA detection agent, a code audit agent, and a license compliance detection agent.

[0009] As a further aspect of the present invention, multiple security detection agents are scheduled to execute corresponding security detection sub-tasks, wherein each security detection agent communicates decoupledly through an asynchronous message queue, and the detection results are output to a result-driven orchestration engine. The specific steps are as follows: Based on the security detection subtasks, generate corresponding agent scheduling information and establish a mapping relationship between the security detection subtasks and the security detection agents. An asynchronous message queue is established based on the agent's scheduling information, and detection tasks are published. The security detection agent asynchronously acquires detection tasks and executes specific detections. Standardized detection result messages are generated for the specific detection results of each security detection agent and output to an asynchronous message queue; The results-driven orchestration engine subscribes to specific test results and establishes upstream and downstream relationships. The result-driven orchestration engine integrates and analyzes the specific detection results from the security detection agent based on the established upstream and downstream relationships, and combines the task state machine to determine whether all predecessor detection nodes have completed execution in the current stage.

[0010] As a further aspect of the present invention, the result-driven orchestration engine parses the detection results output by the upstream security detection agent, generates detection strategy parameters for the downstream security detection agent based on the detection results, and drives the downstream security detection agent to perform detection according to the detection strategy parameters. The specific steps are as follows: Based on the result-driven orchestration engine, the specific detection results output by the upstream security detection agent are analyzed to construct a risk feature set; A risk scoring model is constructed based on a set of risk characteristics, and a comprehensive risk scoring factor is calculated. The results-driven orchestration engine classifies task risk levels based on comprehensive risk scoring factors; task risk levels include Level 1 task risk, Level 2 task risk, and Level 3 task risk. The system dynamically generates downstream detection strategy parameters based on the task risk level, and then publishes and drives the execution of detection strategies to the downstream security detection agent based on these parameters.

[0011] As a further aspect of the present invention, a risk scoring model is constructed based on a risk feature set, and a comprehensive risk scoring factor is calculated. The specific steps are as follows: Each risk feature is extracted based on the risk feature set, and the corresponding risk factors are calculated and analyzed. The risk factors include vulnerability risk factors, license risk factors, and code vulnerability density risk factors. After preprocessing based on risk factors, a risk scoring model is built to output a comprehensive risk scoring factor.

[0012] As a further aspect of the present invention, during the detection process, the status of each detection node is updated in real time using a task state machine. When an abnormality occurs at a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality, and automatic compensation processing is performed on the abnormal node. After the compensation is completed, the subsequent detection process continues to be executed. The specific steps are as follows: During the detection process, the task state machine continuously monitors the running status of each detection node and updates the status of the corresponding node in real time according to the life cycle of the detection task. The task state machine is used to identify anomaly detection nodes and determine the anomaly type. Match the compensation strategy for failed nodes based on the anomaly type; The results drive the orchestration engine to perform automatic compensation processing and restore the state of the detection nodes; The task state machine resumes the detection process and continues to execute subsequent detection tasks.

[0013] A multi-agent collaborative orchestration system based on software supply chain security detection includes: a security detection task acquisition module, a state management module, an asynchronous orchestration driver module, a detection driver execution module, an abnormal node compensation module, and a detection report generation module. The security testing task acquisition module is used to construct security testing tasks by receiving software supply chain security testing requests and basic information of the products to be tested, and to break down the security testing tasks into corresponding security testing sub-tasks according to several testing dimensions. The state management module is used to construct a DAG-shaped detection pipeline based on the data dependencies between security detection subtasks, and to manage the lifecycle state of the detection nodes corresponding to each security detection subtask using a task state machine. The asynchronous orchestration driver module is used to schedule multiple security detection agents to execute corresponding security detection subtasks. The security detection agents communicate decoupledly through an asynchronous message queue and output the detection results to the result-driven orchestration engine. The detection-driven execution module is used to parse the detection results output by the upstream security detection agent based on the result-driven orchestration engine, generate the detection strategy parameters of the downstream security detection agent according to the detection results, and drive the downstream security detection agent to perform detection according to the detection strategy parameters. The abnormal node compensation module is used to update the status of each detection node in real time using the task state machine during the detection process. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality to perform automatic compensation processing on the abnormal node, and the subsequent detection process continues to be executed after the compensation is completed. The test report generation module is used to generate a software supply chain security test report by aggregating the test results of various security testing agents.

[0014] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor performs the steps of the multi-agent collaborative orchestration method based on software supply chain security detection as described above.

[0015] A readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of the multi-agent collaborative orchestration method based on software supply chain security detection as described above.

[0016] The technical effects and advantages of this invention, based on a multi-agent collaborative orchestration method and system for software supply chain security detection, are as follows: This invention utilizes a task state machine to uniformly manage the lifecycle of each detection node and combines it with an asynchronous message queue to achieve decoupled communication between multiple security detection agents, improving the concurrent execution capability of detection tasks and the system's scalability. The result-driven orchestration engine can dynamically generate detection strategy parameters for downstream security detection agents based on the detection results output by upstream security detection agents. This allows subsequent detection resources, detection rules, and detection scope to be adaptively adjusted according to risk levels, avoiding resource waste caused by traditional fixed detection processes and improving the detection depth and accuracy of key risk areas. When a detection node experiences an anomaly, the corresponding failure node compensation strategy is automatically matched according to the anomaly type, and targeted automatic recovery processing is performed on the anomaly detection node. After compensation is completed, the subsequent detection process continues, effectively preventing the interruption of the entire detection task due to partial detection failure, and improving the continuity, stability, and reliability of the software supply chain security detection process.

[0017] This invention achieves traceability of the status of each detection node through refined stage management of the task state machine, significantly improving the observability of the scanning task; it drives downstream scanning strategies with upstream results, concentrating detection resources in high-risk areas and improving overall detection accuracy; it supports seamless collaboration of heterogeneous detection agents such as Go and Python language tools through an asynchronous queue decoupling communication mechanism, enhancing system scalability; and it avoids the overall task being terminated due to partial failures through an automatic failure node compensation mechanism, improving the reliability and integrity of software supply chain security detection. Attached Figure Description

[0018] Figure 1 A flowchart of a multi-agent collaborative orchestration method based on software supply chain security detection provided in an embodiment of the present invention; Figure 2 This is a system block diagram of a multi-agent collaborative orchestration system based on software supply chain security detection, provided for an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of this invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described technical solutions are only a part of this invention, and not all of it. All other technical solutions obtained by those skilled in the art based on the technical solutions of this invention without inventive effort are within the scope of protection of this invention.

[0020] Example 1: As Figure 1 The diagram shown is a flowchart of a multi-agent collaborative orchestration method based on software supply chain security detection provided in an embodiment of the present invention. Figure 1 The execution entity of the method shown can be a software and / or hardware device. The execution entity of this application can include, but is not limited to, at least one of the following: user equipment, network equipment, etc. User equipment can include, but is not limited to, computers, smartphones, personal digital assistants (PDAs), and the aforementioned electronic devices. Network equipment can include, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of computers or network servers. Cloud computing is a type of distributed computing, consisting of a super virtual computer composed of a group of loosely coupled computers. This embodiment does not limit this. Steps S1 to S6 are detailed as follows: Step S1: By receiving software supply chain security testing requests and basic information about the product to be tested, a security testing task is constructed. The security testing task is then broken down into corresponding security testing sub-tasks according to several testing dimensions. The software supply chain security testing request includes the code repository address, software artifact path, dependency manifest file, or identifier of the project to be tested. The basic information about the product to be tested includes project metadata, dependencies, source code directory structure, and license information.

[0021] Step S2: Construct a detection pipeline in the form of a directed acyclic graph (DAG) based on the data dependencies between security detection subtasks, and use a task state machine to manage the lifecycle state of the detection nodes corresponding to each security detection subtask; the task state machine includes the initialization state (PENDING), the queued state (QUEUED), the running state (RUNNING), the successful execution state (SUCCESS), the failed execution state (FAILED), and the compensated state (COMPENSATED).

[0022] Step S3 involves scheduling multiple security detection agents to execute corresponding security detection subtasks. Each security detection agent communicates decoupledly through an asynchronous message queue and outputs the detection results to the result-driven orchestration engine. The security detection agents include an SCA detection agent, a code audit agent, and a license compliance detection agent.

[0023] Step S4: Based on the result-driven orchestration engine, the detection results output by the upstream security detection agent are parsed, the detection strategy parameters of the downstream security detection agent are generated according to the detection results, and the downstream security detection agent is driven to perform detection according to the detection strategy parameters.

[0024] Step S5: During the detection process, the status of each detection node is updated in real time using the task state machine. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality. Automatic compensation processing is performed on the abnormal node, and the subsequent detection process continues after the compensation is completed.

[0025] Step S6: Generate a software supply chain security testing report by aggregating the testing results of each security testing agent.

[0026] Preferably, multiple security detection agents are scheduled to execute corresponding security detection subtasks, wherein each security detection agent communicates decoupledly through an asynchronous message queue, and the detection results are output to the result-driven orchestration engine. The specific steps are as follows: Based on the security detection subtasks, corresponding agent scheduling information is generated, and a mapping relationship is established between the security detection subtasks and the security detection agents. The agent scheduling information includes task identifier, agent type, task priority, detection stage, dependent node identifier, target software artifact path, detection rule version, and resource requirement information. An asynchronous message queue is established based on agent scheduling information, and detection tasks are published. Corresponding asynchronous message topics are established according to the type of security detection agent, with each type of security detection agent corresponding to an independent topic message queue. For example, the software component analysis agent corresponds to the SCA topic queue, the code static audit agent corresponds to the SAST topic queue, and the license detection agent corresponds to the License topic queue. The agent scheduling information is encapsulated into a unified format detection task message, which includes at least the task number, detection object, task parameters, task status, and task creation time, and is published to the corresponding topic queue as a message producer. Due to the use of a publish / subscribe model, each detection agent does not need to directly call each other's interfaces, but instead obtains detection tasks by subscribing to its own topic queue, achieving loosely coupled communication between the detection task scheduling and the detection tool. Security detection agents asynchronously acquire and execute specific security checks. Specifically, each agent continuously listens to its corresponding topic message queue. When a new task message is detected, the agent retrieves the task from the queue and updates its status from queued to running. Subsequently, each agent executes the corresponding security check based on the task parameters. Specifically, the software composition analysis agent parses software dependencies, identifies third-party components and associated vulnerabilities; the license compliance detection agent analyzes the license types and compatibility relationships of dependent components; and the static code audit agent performs static analysis on the source code according to detection rules. When there are no dependencies between multiple detection tasks, the parallel scheduling module simultaneously publishes the tasks to multiple topic queues, allowing multiple security detection agents to execute checks concurrently, improving overall detection efficiency. When dependencies exist between detection tasks, the detection nodes are executed sequentially according to the task state machine. Standardized detection result messages are generated based on the specific detection results of each security detection agent and output to an asynchronous message queue. The specific detection results of each security detection agent are uniformly encapsulated to generate standardized detection result messages. These messages include task number, agent identifier, detection object identifier, detection result data, detection completion time, detection status, and result summary. Specifically, the software component analysis agent outputs component identifier, component version, vulnerability number, vulnerability level, and dependency information; the license detection agent outputs license type, compatibility analysis results, and a list of non-compliant components; and the code static audit agent outputs vulnerability location, vulnerability type, risk level, and corresponding code path. After encapsulation, each security detection agent, acting as a message producer, writes the detection result message to the detection result topic queue and synchronously updates the detection node status in the task state machine to a successful execution status (SUCCESS); if the detection fails, it updates to a failed execution status (FAILED) and triggers a failure node compensation mechanism.

[0027] The result-driven orchestration engine subscribes to specific detection results and establishes upstream and downstream relationships. As a message consumer of the detection result topic queue, the engine continuously monitors each detection result topic. When a new detection result message is received, the engine first verifies the validity of the result based on the task number, detection stage, and agent identifier. Then, it determines the downstream detection node corresponding to the current detection result based on the task dependency graph and establishes a mapping relationship between upstream detection results and downstream detection tasks. Simultaneously, the detection results are cached in a unified detection result data pool, and the input-output relationships between each detection node are recorded. This provides unified data input for subsequent risk score calculation, dynamic generation of detection strategies, and scheduling of downstream detection agents, enabling the sharing of detection results and collaborative detection processes between various specialized security detection agents without direct communication.

[0028] The result-driven orchestration engine, based on established upstream and downstream relationships, fuses and analyzes specialized detection results from security detection agents, and uses a task state machine to determine whether all preceding detection nodes have completed execution in the current stage. When preset execution conditions are met, the fused detection results and corresponding policy parameters are encapsulated into a new detection task message and republished to the topic queue of the corresponding downstream security detection agent, driving the execution of the next stage of the detection task. This achieves collaborative orchestration and automatic advancement of the detection process among multiple security detection agents based on asynchronous message queues.

[0029] Preferably, the result-driven orchestration engine parses the detection results output by the upstream security detection agent, generates detection strategy parameters for the downstream security detection agent based on the detection results, and drives the downstream security detection agent to perform detection according to the detection strategy parameters. The specific steps are as follows: Based on the result-driven orchestration engine, the system analyzes the specialized detection results output by the upstream security detection agent to construct a risk feature set. This risk feature set includes three subsets: a first-class subset, a second-class subset, and a third-class subset. The first-class subset includes component identifiers, component version numbers, Common Vulnerability IDs (CVEs), CVSS scores, vulnerability severity levels, number of vulnerabilities, and dependency levels output by the software component analysis agent. The second-class subset includes license types, license compatibility levels, and number of license conflicts output by the license compliance detection agent. The third-class subset includes vulnerability types, vulnerability locations, number of vulnerabilities, number of dangerous function calls, and vulnerability impact scope output by the static code audit agent. A risk scoring model is constructed based on a set of risk characteristics, and a comprehensive risk scoring factor is calculated. The results-driven orchestration engine classifies task risk levels based on comprehensive risk scoring factors; task risk levels include Level 1 task risk, Level 2 task risk, and Level 3 task risk. The system dynamically generates downstream detection strategy parameters based on the task risk level, and then publishes and drives the execution of detection strategies to the downstream security detection agent based on these parameters.

[0030] Preferably, a risk scoring model is constructed based on a set of risk characteristics, and a comprehensive risk scoring factor is calculated. The specific steps are as follows: Each risk feature is extracted based on the risk feature set, and the corresponding risk factors are calculated and analyzed. The risk factors include vulnerability risk factors, license risk factors, and code vulnerability density risk factors. After preprocessing based on risk factors, a risk scoring model is built to output a comprehensive risk score factor. The calculation formula is as follows: In the formula: Comprehensive risk scoring factors, The weighting coefficients for vulnerability risk factors. As a vulnerability risk factor, The weighting coefficients for license risk factors. For license risk factors, The weighting coefficients of the code vulnerability density risk factor. This is a code vulnerability density risk factor.

[0031] Specifically, the risk factors corresponding to each risk characteristic are calculated and analyzed as follows: In the formula: As a vulnerability risk factor, Let N be the CVSS score corresponding to the i-th vulnerability, and N be the number of vulnerabilities detected. In the formula: For license risk factors, For the number of license conflicts, Total number of all licenses; ; In the formula: As a code vulnerability density risk factor, For the number of vulnerabilities, This represents the total number of lines of source code.

[0032] It is important to emphasize that all data parameters used in the calculations must undergo preprocessing, including dimensionless conversion, before being used in the calculations.

[0033] Preferably, the result-driven orchestration engine classifies task risk levels based on a comprehensive risk scoring factor. The task risk levels include Level 1, Level 2, and Level 3 task risks. The comprehensive risk scoring factor is compared with a preset risk threshold range. If the comprehensive risk scoring factor exceeds the upper limit of the preset risk threshold range, the corresponding task is classified as Level 1 task risk. If the comprehensive risk scoring factor is within the preset risk threshold range, the corresponding task is classified as Level 2 task risk. If the comprehensive risk scoring factor is below the lower limit of the preset risk threshold range, the corresponding task is classified as Level 3 task risk.

[0034] Preferably, downstream detection strategy parameters are dynamically generated based on the task risk level, and detection strategies are published to and executed by the downstream security detection agent based on these parameters. The specific steps are as follows: Based on the risk level, the result-driven orchestration engine automatically generates the detection strategy parameters corresponding to the downstream security detection agent. When the detection result belongs to the first-level task risk, the configured code static audit agent enters the deep scan mode, automatically expands the scope of the target component call chain analysis, increases the priority of dangerous function detection rules and taint propagation analysis rules, and increases the CPU resource quota and the number of scanning threads. When the detection result belongs to the second-level task risk, only the relevant code areas of high-risk components are scanned, and the default resource configuration is maintained. When the detection result belongs to the third-level task risk, the fast scan mode is adopted, only the basic vulnerability detection rules are executed, the scan scope is narrowed, and resource consumption is reduced, thereby realizing the dynamic tilting of detection resources towards high-risk areas.

[0035] The result-driven orchestration engine encapsulates the generated detection strategy parameters into standardized strategy messages and sends them to the corresponding downstream security detection agents via an asynchronous message queue. Upon receiving the strategy message, the downstream security detection agent dynamically updates its existing detection configuration and reconstructs the detection task based on the aforementioned strategy parameters. Static code analysis is performed only on the key components, call paths, and target code regions specified in the strategy message. Simultaneously, the detection execution status is fed back to the task state machine in real time, completing the detection task for this stage. This achieves a collaborative orchestration mechanism where upstream detection results drive dynamic adjustments to downstream detection strategies, improving the targeting, efficiency, and accuracy of software supply chain security detection.

[0036] It should be noted that the detection strategy parameters include at least: target detection object parameters, detection range parameters, detection rule parameters, detection priority parameters, resource scheduling parameters, scanning mode parameters, and detection result output parameters. Specifically, the target detection object parameters determine the software components and code modules to be detected; the detection range parameters limit the depth of call chain analysis and the scope of data flow propagation; the detection rule parameters select the corresponding vulnerability detection rule set and taint propagation analysis rules; the detection priority parameters determine the execution order of detection tasks; the resource scheduling parameters dynamically configure CPU resource quotas, the number of scanning threads, and execution time; the scanning mode parameters determine whether to use deep scanning mode, standard scanning mode, or fast scanning mode; and the detection result output parameters control the content and granularity of the detection report. Through the coordinated configuration of the above detection strategy parameters, the downstream security detection agent can perform adaptive detection based on the upstream detection results, rather than using a fixed scanning strategy, thus improving the targeting, resource utilization efficiency, and detection accuracy of software supply chain security detection.

[0037] Preferably, during the detection process, the status of each detection node is updated in real time using a task state machine. When an anomaly occurs at a detection node, the corresponding failure node compensation strategy is triggered according to the anomaly type to perform automatic compensation processing on the anomaly node. After the compensation is completed, the subsequent detection process continues. The specific steps are as follows: During the detection process, the task state machine continuously monitors the running status of each detection node and updates the status of the corresponding node in real time according to the life cycle of the detection task. The task state machine identifies and determines the anomaly detection nodes and their types. When the task state machine detects that a detection node has not completed its detection task within a preset time, the detection process has exited abnormally, or an error status code has been returned, the corresponding detection node's status is updated to FAILED, and the anomaly analysis module is triggered to read the node's runtime logs, error codes, and resource monitoring information to classify the cause of the anomaly. Anomaly types include: Communication anomalies: asynchronous message queue connection interruption, network timeout, or message delivery failure; Resource anomalies: insufficient CPU, memory, or disk space causing the detection task to fail to execute normally; Rule anomalies: detection rule loading failure, rule version mismatch, or rule parsing error; Tool anomalies: security detection agent process exit, detection engine crash, or abnormal runtime environment; Data anomalies: corrupted files to be detected, missing dependent components, or incorrect detection data format.

[0038] The compensation strategy for failed nodes is matched according to the anomaly type. Specifically: when the anomaly type is communication anomaly, a message redelivery compensation strategy is adopted to re-establish the message queue connection and resend the detection task according to the exponential backoff method; when the anomaly type is resource anomaly, a resource reallocation compensation strategy is adopted to dynamically adjust the CPU resource quota, memory resources and the number of scanning threads, and reschedule the detection task to a security detection agent with sufficient resources; when the anomaly type is rule anomaly, a rule degradation compensation strategy is adopted to automatically switch to a compatible version of the detection rule or the default rule set and then re-execute the detection; when the anomaly type is tool anomaly, an agent restart compensation strategy is adopted to restart the corresponding security detection agent and restore the unfinished detection task; when the anomaly type is data anomaly, a data repair compensation strategy is adopted to reacquire the data to be detected or perform data integrity verification and then restart the detection task.

[0039] The result-driven orchestration engine performs automatic compensation processing and restores the detection node state. Specifically, the result-driven orchestration engine encapsulates the matched compensation strategy into a compensation task and sends it to the corresponding security detection agent for execution. During compensation execution, the detection node state is updated from the execution failure state (FAILED) to the compensation execution state (COMPENSATING), and the compensation start time and compensation count are re-recorded. After compensation is completed, the detection results are re-acquired and their integrity is verified. When the detection results meet the preset requirements, the detection node state is updated to the compensation completed state (COMPENSATED), and a compensation success flag is recorded. If compensation fails and the maximum number of compensation counts has not been reached, the corresponding compensation strategy is executed again. When the number of compensation counts reaches the preset upper limit, the detection node state is updated to the final failure state, and an abnormal alarm message is generated.

[0040] The task state machine resumes the detection process and continues to execute subsequent detection tasks. Specifically, the task state machine continuously monitors the compensation completion status. When the detection node status is updated to the compensation completion status (COMPENSATED), the result-driven orchestration engine re-verifies whether all predecessor nodes in the DAG task graph to which the detection node belongs have been completed. If the conditions for starting subsequent detection nodes are met, the compensated detection results are rewritten into the result-driven orchestration engine, and the comprehensive risk score is recalculated. Based on the latest risk score, the detection strategy parameters corresponding to the downstream security detection agent are regenerated, and then the downstream detection task is republished to the asynchronous message queue to drive subsequent detection nodes to continue execution. If the compensated detection results affect the risk assessment of completed detection nodes, the risk status and detection strategy of the relevant detection nodes are updated synchronously to ensure the consistency of the security detection process throughout the software supply chain.

[0041] Example 2: In this embodiment of the invention, a financial institution releases a version of its online banking system and needs to conduct software supply chain security testing on the software artifact to prevent vulnerabilities in third-party open-source components, license violations, and source code security flaws from entering the production environment. A multi-agent collaborative orchestration method based on software supply chain security testing is used in this scenario. After receiving the software supply chain security testing request, the testing platform simultaneously obtains basic information about the product to be tested, including project identifier, Git repository address, software artifact storage path, Maven dependency list (pom.xml), source code directory structure, programming language (Java), and the version number to be tested. Subsequently, the testing platform constructs the software supply chain security testing task based on the basic information and decomposes the task into three subtasks according to different security testing dimensions: Software Composition Analysis (SCA), License Compliance Testing, and Static Code Auditing (SAST). The SCA subtask is responsible for identifying third-party dependent components and vulnerability information; the License Compliance Testing subtask is responsible for testing open-source license compatibility; and the Static Code Auditing subtask is responsible for analyzing security vulnerabilities such as SQL injection, command execution, and deserialization in the source code.

[0042] The detection platform constructs a directed acyclic graph (DAG) detection pipeline based on the data dependencies between various security detection subtasks. Since static code auditing requires determining key scanning targets based on software composition analysis results, the software composition analysis subtask and the license compliance detection subtask are located in the first detection stage. These two subtasks have no data dependency and can be executed in parallel. The static code auditing subtask is located in the second detection stage, depending on the detection results output from the first stage, and therefore serves as a successor node in the DAG. Simultaneously, the task state machine establishes a lifecycle management mechanism for each detection node, defining the node state sequentially as: QUEUED, RUNNING, SUCCESS, FAILED, COMPENSATING, and COMPENSATED. This mechanism records the execution status and state transition process of each detection node in real time.

[0043] Based on the DAG detection pipeline, agent scheduling information is generated, and corresponding detection tasks are published to different security detection agents via asynchronous message queues. The software composition analysis agent and the license compliance detection agent listen to their respective topic message queues. When a new detection task message is detected, the agent pulls the task from the message queue and updates the detection node status from the queued waiting state to the executing state. The software composition analysis agent parses the Maven dependencies in the project, identifies third-party components such as Log4j and Spring Framework, and further queries the public vulnerability database, discovering a high-risk remote code execution vulnerability in the Log4j component. It also collects component version, vulnerability number, CVSS score, and dependency propagation path statistics. The license compliance detection agent synchronously analyzes all open-source component license types, identifying license compatibility risks between some GPL licensed components and commercial closed-source projects. After completing the detection, both agents encapsulate the detection results into standardized detection result messages and send them to the result-driven orchestration engine via asynchronous message queues, achieving decoupled communication between multiple security detection agents.

[0044] The results-driven orchestration engine continuously monitors the detection result topic queue. Upon receiving specific detection results from the software composition analysis agent and the license compliance detection agent, it performs unified analysis on the results, extracting risk features such as vulnerable components, vulnerability levels, CVSS scores, license conflict information, and component dependencies. It then constructs a risk feature set and establishes a comprehensive risk scoring model to calculate the comprehensive risk score for the current detection task. When the results-driven orchestration engine determines that the current project belongs to a Level 1 risk task, it automatically generates detection strategy parameters for the downstream code static audit agent, including target detection object parameters, detection scope parameters, detection rule parameters, and resource scheduling parameters. Specifically, the target detection object is limited to all business modules referencing the Log4j component; the detection scope parameter increases the call chain analysis depth from the default 3 layers to 8 layers and expands the data flow propagation analysis scope; the detection rule parameters increase the priority of dangerous function detection rules, deserialization vulnerability rules, and taint propagation analysis rules; and the resource scheduling parameters increase the number of scanning threads from 4 to 8, while also increasing CPU resource quotas. Subsequently, the results-driven orchestration engine repackages the aforementioned detection strategy parameters into detection task messages and sends them to the code static audit agent via an asynchronous message queue, driving the agent to perform targeted static analysis based on the new detection strategy, instead of performing a full scan of the entire source code.

[0045] During the execution of the code static auditing agent, the task state machine continuously monitors the running status of each detection node. When a rule loading fails due to a version conflict, the task state machine detects that the code static auditing node returns an exception status code and updates the node's status from "in execution" to "execution failed." The exception analysis module further analyzes the runtime log, classifying the exception as a rule exception, and then triggers the failure node compensation mechanism. The result-driven orchestration engine automatically matches a rule degradation compensation strategy based on the exception type, switches the advanced detection rule to a compatible version rule set, reloads the detection rule, and reschedules the code static auditing agent to execute the detection, while updating the detection node's status to "compensation execution." After compensation is completed, the code static auditing agent successfully completes the detection task, the detection node's status is updated to "compensation completed," and the task state machine re-verifies that all predecessor nodes in the DAG detection pipeline have completed execution before continuing the subsequent detection process, preventing the interruption of the entire software supply chain security detection task due to a local node exception.

[0046] Once all security detection agents have completed their tests, the results-driven orchestration engine aggregates software component analysis results, license compliance test results, and static code audit results to generate a software supply chain security detection report. This report includes not only third-party component vulnerability information, vulnerability numbers, CVSS scores, license compatibility analysis results, and a list of source code security vulnerabilities, but also the lifecycle status of each detection node, anomaly compensation records, dynamic adjustment process of detection strategies, and overall risk level. Specifically, the report identifies a high-risk remote code execution vulnerability in the Log4j component, a deserialization risk in related business modules, and GPL license compatibility issues, providing corresponding component upgrade and code repair suggestions. After developers complete vulnerability repairs and component upgrades based on the report, they re-initiate the detection request. The system then executes the security test again according to the aforementioned process, thereby achieving automated collaborative orchestration, dynamic detection strategy adjustment, and anomaly self-recovery handling throughout the entire software supply chain security detection process, improving the accuracy, continuity, and reliability of software supply chain security detection.

[0047] Example 3: A multi-agent collaborative orchestration system based on software supply chain security detection, comprising: a security detection task acquisition module, a state management module, an asynchronous orchestration driver module, a detection driver execution module, an anomaly node compensation module, and a detection report generation module; the security detection task acquisition module is connected to the state management module, the state management module is connected to the asynchronous orchestration driver module, the asynchronous orchestration driver module is connected to the detection driver execution module, the detection driver execution module is connected to the anomaly node compensation module, and the anomaly node compensation module is connected to the detection report generation module; The security testing task acquisition module is used to construct security testing tasks by receiving software supply chain security testing requests and basic information of the products to be tested, and to break down the security testing tasks into corresponding security testing sub-tasks according to several testing dimensions. The state management module is used to construct a DAG-shaped detection pipeline based on the data dependencies between security detection subtasks, and to manage the lifecycle state of the detection nodes corresponding to each security detection subtask using a task state machine. The asynchronous orchestration driver module is used to schedule multiple security detection agents to execute corresponding security detection subtasks. The security detection agents communicate decoupledly through an asynchronous message queue and output the detection results to the result-driven orchestration engine. The detection-driven execution module is used to parse the detection results output by the upstream security detection agent based on the result-driven orchestration engine, generate the detection strategy parameters of the downstream security detection agent according to the detection results, and drive the downstream security detection agent to perform detection according to the detection strategy parameters. The abnormal node compensation module is used to update the status of each detection node in real time using the task state machine during the detection process. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality to perform automatic compensation processing on the abnormal node, and the subsequent detection process continues to be executed after the compensation is completed. The test report generation module is used to generate a software supply chain security test report by aggregating the test results of various security testing agents.

[0048] like Figure 2 The diagram shown is a system block diagram of a multi-agent collaborative orchestration system based on software supply chain security detection according to an embodiment of the present invention, which can be used to execute... Figure 1 The steps in the method embodiments shown are implemented in a similar manner and have similar technical effects, and will not be repeated here.

[0049] An electronic device includes a memory and a processor. The memory stores a computer program. When the processor runs the computer program stored in the memory, the processor executes the steps of the multi-agent cooperative orchestration method and system based on software supply chain security detection as described above. The electronic device includes: a processor, a memory, and a computer program; wherein... A memory is used to store the computer program, and the memory may also be flash memory. The computer program is, for example, an application program or functional module that implements the above method.

[0050] The processor is used to execute the computer program stored in the memory to implement the various steps performed by the device in the above method. For details, please refer to the relevant descriptions in the preceding method embodiments.

[0051] Alternatively, the memory can be either standalone or integrated with the processor.

[0052] When the memory is a device independent of the processor, the device may further include: A bus is used to connect the memory and the processor.

[0053] A readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of the multi-agent collaborative orchestration method based on software supply chain security detection as described above.

[0054] The readable storage medium can be a computer storage medium or a communication medium. A communication medium includes any medium that facilitates the transfer of computer programs from one location to another. A computer storage medium can be any available medium accessible to a general-purpose or special-purpose computer. For example, a readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application-Specific Integrated Circuit (ASIC). Alternatively, the ASIC can be located in a user equipment. Of course, the processor and the readable storage medium can also exist as discrete components in a communication device. The readable storage medium can be a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0055] The present invention also provides a program product including executable instructions stored in a readable storage medium. At least one processor of the device can read the executable instructions from the readable storage medium, and the at least one processor executes the executable instructions to cause the device to implement the methods provided in the various embodiments described above.

[0056] In the embodiments of the above-described device, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0057] Through the above embodiments, this invention constructs security testing tasks by receiving software supply chain security testing requests, decomposes them into multiple security testing sub-tasks according to different testing dimensions, and then constructs a DAG-type testing pipeline based on the data dependencies between the security testing sub-tasks, achieving orderly collaborative orchestration of multiple security testing tasks. It utilizes a task state machine to uniformly manage the lifecycle of each testing node and combines asynchronous message queues to achieve decoupled communication between multiple security testing agents, improving the concurrent execution capability of testing tasks and the system's scalability. The result-driven orchestration engine can dynamically generate testing strategy parameters for downstream security testing agents based on the testing results output by upstream security testing agents, enabling subsequent testing resources, testing rules, and testing scope to be adaptively adjusted according to risk levels, avoiding resource waste caused by traditional fixed testing processes, and improving the testing depth and accuracy of key risk areas. When an anomaly occurs at a detection node, the system automatically matches the corresponding failure node compensation strategy based on the anomaly type, performs targeted automatic recovery processing on the anomaly detection node, and continues to advance the subsequent detection process after compensation is completed. This effectively avoids the interruption of the entire detection task due to partial detection failure, improves the continuity, stability, and reliability of the software supply chain security detection process, and ultimately generates a complete, accurate, and traceable security detection report, providing more efficient and intelligent technical support for software supply chain security risk identification and vulnerability remediation.

[0058] This invention achieves traceability of the status of each detection node through refined stage management of the task state machine, significantly improving the observability of the scanning task; it drives downstream scanning strategies through upstream results, concentrating detection resources on high-risk areas. For example, after upstream SCA discovers a high-risk dependency, code auditing focuses on analyzing the call chain of that dependency, improving overall detection accuracy; through an asynchronous queue decoupling communication mechanism, it supports seamless collaboration between heterogeneous detection agents such as Go and Python language tools, enhancing scalability; and through an automatic failure node compensation mechanism, it avoids partial failures leading to overall task termination, improving the reliability and integrity of software supply chain security detection.

[0059] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

[0060] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A multi-agent collaborative orchestration method based on software supply chain security detection, characterized in that, Includes the following steps: By receiving software supply chain security testing requests and basic information about the products to be tested, a security testing task is constructed, and the security testing task is broken down into corresponding security testing sub-tasks according to several testing dimensions. A DAG-based detection pipeline is constructed based on the data dependencies between security detection subtasks, and a task state machine is used to manage the lifecycle state of the detection nodes corresponding to each security detection subtask. By scheduling multiple security detection agents to execute corresponding security detection subtasks, each security detection agent communicates decoupledly through an asynchronous message queue and outputs the detection results to the result-driven orchestration engine. The result-driven orchestration engine parses the detection results output by the upstream security detection agent, generates the detection strategy parameters of the downstream security detection agent based on the detection results, and drives the downstream security detection agent to perform detection according to the detection strategy parameters. During the detection process, the status of each detection node is updated in real time using the task state machine. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality. Automatic compensation processing is performed on the abnormal node, and the subsequent detection process continues after the compensation is completed. A software supply chain security testing report is generated by aggregating the testing results from various security testing agents.

2. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 1, characterized in that, The task state machine includes the initialization state, the queue waiting state, the execution state, the execution success state, the execution failure state, and the compensated state.

3. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 1, characterized in that, Security detection agents include SCA detection agents, code audit agents, and license compliance detection agents.

4. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 1, characterized in that, By scheduling multiple security detection agents to execute corresponding security detection subtasks, where each security detection agent communicates decoupledly through an asynchronous message queue, and the detection results are output to a result-driven orchestration engine, the specific steps are as follows: Based on the security detection subtasks, generate corresponding agent scheduling information and establish a mapping relationship between the security detection subtasks and the security detection agents. An asynchronous message queue is established based on the agent's scheduling information, and detection tasks are published. The security detection agent asynchronously acquires detection tasks and executes specific detections. Standardized detection result messages are generated for the specific detection results of each security detection agent and output to an asynchronous message queue; The results-driven orchestration engine subscribes to specific test results and establishes upstream and downstream relationships. The result-driven orchestration engine integrates and analyzes the specific detection results from the security detection agent based on the established upstream and downstream relationships, and combines the task state machine to determine whether all predecessor detection nodes have completed execution in the current stage.

5. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 1, characterized in that, The result-driven orchestration engine parses the detection results output by the upstream security detection agent, generates detection strategy parameters for the downstream security detection agent based on the detection results, and drives the downstream security detection agent to perform detection according to the detection strategy parameters. The specific steps are as follows: Based on the result-driven orchestration engine, the specific detection results output by the upstream security detection agent are analyzed to construct a risk feature set; A risk scoring model is constructed based on a set of risk characteristics, and a comprehensive risk scoring factor is calculated. The results-driven orchestration engine classifies task risk levels based on comprehensive risk scoring factors; The task risk levels are divided into Level 1 task risk, Level 2 task risk, and Level 3 task risk; The system dynamically generates downstream detection strategy parameters based on the task risk level, and then publishes and drives the execution of detection strategies to the downstream security detection agent based on these parameters.

6. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 5, characterized in that, The risk scoring model is constructed based on a set of risk characteristics, and the comprehensive risk scoring factor is calculated. The specific steps are as follows: Each risk feature is extracted based on the risk feature set, and the corresponding risk factors are calculated and analyzed. The risk factors include vulnerability risk factors, license risk factors, and code vulnerability density risk factors. After preprocessing based on risk factors, a risk scoring model is built to output a comprehensive risk scoring factor.

7. The multi-agent collaborative orchestration method based on software supply chain security detection according to claim 1, characterized in that, During the detection process, the status of each detection node is updated in real time using a task state machine. When an anomaly occurs at a detection node, the corresponding failure node compensation strategy is triggered according to the anomaly type to perform automatic compensation processing on the anomaly node. After the compensation is completed, the subsequent detection process continues. The specific steps are as follows: During the detection process, the task state machine continuously monitors the running status of each detection node and updates the status of the corresponding node in real time according to the life cycle of the detection task. The task state machine is used to identify anomaly detection nodes and determine the anomaly type. Match the compensation strategy for failed nodes based on the anomaly type; The results drive the orchestration engine to perform automatic compensation processing and restore the state of the detection nodes; The task state machine resumes the detection process and continues to execute subsequent detection tasks.

8. A multi-agent collaborative orchestration system based on software supply chain security detection, applied to the multi-agent collaborative orchestration method based on software supply chain security detection as described in any one of claims 1-7, characterized in that, It includes a security detection task acquisition module, a status management module, an asynchronous orchestration driver module, a detection driver execution module, an abnormal node compensation module, and a detection report generation module; The security testing task acquisition module is used to construct security testing tasks by receiving software supply chain security testing requests and basic information of the products to be tested, and to break down the security testing tasks into corresponding security testing sub-tasks according to several testing dimensions. The state management module is used to construct a DAG-shaped detection pipeline based on the data dependencies between security detection subtasks, and to manage the lifecycle state of the detection nodes corresponding to each security detection subtask using a task state machine. The asynchronous orchestration driver module is used to schedule multiple security detection agents to execute corresponding security detection subtasks. The security detection agents communicate decoupledly through an asynchronous message queue and output the detection results to the result-driven orchestration engine. The detection-driven execution module is used to parse the detection results output by the upstream security detection agent based on the result-driven orchestration engine, generate the detection strategy parameters of the downstream security detection agent according to the detection results, and drive the downstream security detection agent to perform detection according to the detection strategy parameters. The abnormal node compensation module is used to update the status of each detection node in real time using the task state machine during the detection process. When an abnormality occurs in a detection node, the corresponding failure node compensation strategy is triggered according to the type of abnormality to perform automatic compensation processing on the abnormal node, and the subsequent detection process continues to be executed after the compensation is completed. The test report generation module is used to generate a software supply chain security test report by aggregating the test results of various security testing agents.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor runs the computer program stored in the memory, the processor performs the steps of the multi-agent collaborative orchestration method based on software supply chain security detection as described in any one of claims 1-7.

10. A readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it is used to implement the steps of the multi-agent collaborative orchestration method based on software supply chain security detection as described in any one of claims 1-7.

Images