The invention discloses an
open source software risk detection method and device based on an SBOM
list, equipment and a medium, and relates to the technical field of
software detection. The method comprises the following steps: acquiring an SBOM of target
software, and analyzing component information of the SBOM; generating a feature character string according to the component information, and calculating a feature hash value through a hash
algorithm; based on a known
open source component, analyzing component information and
vulnerability information of the component, calculating a feature hash value of the component, and storing the feature hash value to form a feature
database; searching a matching item in a feature
database based on the feature hash value of the target software component, and if the matching item is found, obtaining a
license and
vulnerability information of the target software component; if not, marking, manually judging and supplementing the data to the feature
database; constructing a
license compatibility matrix, and checking the compatibility of the obtained
license and the overall license of the project; and comparing the acquired
vulnerability information with a feature database, calculating vulnerability severity by combining a CVSS scoring model, and generating a priority repair report. According to the method, the software security detection speed and accuracy are improved.