CN118643504B - Automatic evaluation system, method, equipment and storage medium for safety of open source project - Google Patents

Abstract

The invention provides an automatic evaluation system, method, equipment and storage medium for open source project security, wherein the system comprises: the data acquisition module is used for acquiring open source data of an open source project, wherein the open source data comprises a code library, a dependency relationship and an update record; the parameter calculation module is used for acquiring safety parameters affecting project safety according to the acquired open source data; the cross verification module is used for verifying the accuracy of the safety parameters through a cross calculation method; the virtual environment simulation module is used for simulating bifurcation possibility and bifurcation point of the open source project; and the bifurcation point evaluation module is used for evaluating the security of the bifurcation point to perform security evaluation on the opening source project. The invention can comprehensively and accurately evaluate the safety of the open source project, and effectively predict and quantify the safety risk in the bifurcation process.

Description

An open source project security automatic assessment system, method, device and storage medium

Technical Field

The present invention relates to the field of data processing technology, and more specifically, to an open source project security automatic assessment system, method, device and storage medium.

Background Art

In the fields of software engineering and network security, open source projects have attracted widespread attention due to their openness and collaboration. Open source projects allow developers to share resources such as code, tools, and documents, which promotes the rapid development and innovation of technology. However, with the increase in open source projects, their security issues have become increasingly prominent. Most of the existing open source project security assessment methods rely on manual review and simple automated tools, which have problems such as low efficiency, lack of accuracy, and difficulty in comprehensive assessment.

In the process of implementing the embodiments of the present invention, the inventors found that there are at least the following problems or defects in the prior art: first, the existing evaluation systems often lack the ability to comprehensively collect open source project data, resulting in incomplete or inaccurate evaluation results; second, the calculation of parameters for project security is not in-depth enough, and it is difficult to accurately reflect the potential security risks of the project; in addition, the existing cross-validation method may not be able to effectively identify and process redundancy and outliers in security parameters, affecting the reliability of the evaluation results; third, the simulation of the possibility of forking and forking points of open source projects is not accurate enough, making it difficult to provide effective risk warnings for project maintainers; finally, the existing evaluation systems often ignore the interactive effects of different forking paths on project security, and are unable to comprehensively evaluate the impact of forks on the overall security of the project.

Summary of the invention

The present invention provides an open source project security automatic assessment system, method, device and storage medium.

In a first aspect of the present invention, there is provided an open source project security automatic assessment system, comprising:

A data collection module, used to collect open source data of open source projects, wherein the open source data includes code base, dependency relationships, and update records;

Parameter calculation module, used to obtain security parameters that affect project security based on collected open source data;

A cross-validation module is used to verify the accuracy of security parameters through a cross-calculation method;

A virtual environment simulation module, used to simulate the possibility and fork points of open source projects;

The fork point assessment module is used to conduct security assessments on open source projects by evaluating the security of fork points;

Wherein, the virtual environment simulation module includes:

The environment configuration unit is used to build a virtual environment that simulates the development and operation of open source projects and defines the environment properties through configuration parameter sets;

The fork simulation unit is used to simulate the fork process of open source projects under different conditions and quantify the possibility of forks through the fork probability, as shown in formula (1);

(1);

In the formula, is the fork probability; is an environment variable; is the configuration parameter set; is the probability function;

The risk prediction unit is used to predict the security risks that may occur during the forking process and evaluate the risk level through risk scoring, as shown in formula (2);

(2);

In the formula, For project characteristics; is a function for assessing risk based on fork probability and project characteristics;

The interactive impact analysis unit is used to generate bifurcation paths and analyze the interactive impact of different bifurcation paths on project security, and quantify the interaction between paths through impact factors, as shown in calculation formula (3);

(3);

In the formula, is the impact factor; is the probability of the first fork path; is the probability of the second fork path; is the probability of the nth fork path; is a function of the interaction between different fork paths.

Further, the parameter calculation module includes: a code base analysis unit for analyzing security vulnerabilities and potential risks in the code base;

Dependency analysis unit, used to evaluate the security of project dependencies and their impact on the security of the main project;

An update record analysis unit, used to monitor and identify update records, and extract code bases and dependencies corresponding to the update records;

Among them, the security vulnerabilities and potential risks in the analysis code base are shown in formula (4);

(4)

In the formula, is the vulnerability density; is the number of vulnerabilities; is the code base size;

The security of project dependencies and their impact on the security of the main project are evaluated as shown in formula (5);

(5)

In the formula, For dependencies Safety score; For dependencies The weight of is the total number of dependencies.

Furthermore, the cross-validation module comprises:

The consistency check unit is used to compare the security parameters calculated from different open source data to ensure the consistency of the results;

A redundancy check unit, used to detect and evaluate the redundancy between safety parameters to enhance the accuracy of the evaluation;

Anomaly detection unit, used to identify abnormal values in security parameters.

Further, the bifurcation point assessment module includes: a safety quantification unit, used to quantify the safety risk of the bifurcation point;

Impact Assessment Unit, which is used to assess the impact of forks on the overall security of open source projects;

The risk mitigation advice unit is used to provide risk mitigation measures and recommendations based on the assessment results.

Further, the bifurcation points include: vulnerability bifurcation points, functional bifurcation points, and maintenance bifurcation points. Further, the impact assessment unit includes: a version identification subunit for analyzing the version history of the open source project, identifying bifurcation points in version updates, and determining version changes and differences of these bifurcation points;

Contributor analysis subunit, which is used to evaluate the behavior patterns of contributors related to the fork point and their impact on the security of the project;

The code change detection subunit is used to identify the addition, modification or deletion of code at the fork point;

The dependency tracking subunit is used to track the dependencies introduced by the fork point and evaluate the security of the dependencies.

Furthermore, the security parameters include: vulnerability density parameters, dependency security parameters, and update frequency parameters.

In a second aspect of the present invention, a method for automatically assessing the security of an open source project is provided, comprising:

Use the data collection module to collect open source project data including code base, dependencies and update records;

Use the parameter calculation module to calculate the safety parameters that affect the project safety based on the collected data;

Verify the accuracy of the security parameters through the consistency check unit, redundancy check unit and anomaly detection unit of the cross-validation module;

The fork simulation unit of the virtual environment simulation module is used to simulate the fork process of open source projects under different conditions;

Use the risk prediction unit to predict possible security risks that may arise during the fork process;

Quantify the safety risk of the bifurcation point using the safety quantification unit of the bifurcation point assessment module;

Use the Impact Assessment Unit to assess the impact of forks on the overall security of open source projects.

In a third aspect of the present invention, an electronic device is provided, comprising: at least one processor, a memory and an input-output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute any one of the methods described in the second aspect.

In a fourth aspect of the present invention, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes any one of the methods in the second aspect.

According to the above-mentioned embodiment of the present invention, at least the following beneficial effects are achieved: the automatic security assessment system of the open source project of the present invention realizes a comprehensive and automated assessment of the security of the open source project by integrating modules such as data collection, parameter calculation, cross-validation, virtual environment simulation and bifurcation point assessment. The system can effectively collect and analyze key data such as code base, dependency relationship and update record, and obtain security parameters that affect the security of the project. Through the consistency check, redundancy check and anomaly detection of the cross-validation module, the system can ensure the accuracy and reliability of the assessment results. In addition, the virtual environment simulation module can simulate the bifurcation possibility and bifurcation point of the project, providing strong support for risk prediction and assessment. In addition, the system of the present invention also has the ability to quantitatively evaluate the security of bifurcation points and deeply analyze the impact on the overall security of open source projects. Through sub-units such as version identification, contributor analysis, code change detection and dependency tracking, the system can carefully evaluate the specific impact of bifurcation points on project security. The risk mitigation suggestion unit provides users with practical security measures and suggestions based on the assessment results, helping project maintainers to identify and respond to potential security risks in a timely manner. Overall, the present invention can not only improve the efficiency of security assessment of open source projects, but also enhance the security management level of open source projects by providing accurate risk assessment and practical security suggestions.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

FIG1 is a schematic diagram of the structure of an automatic security assessment system for open source projects provided by an embodiment of the present invention;

FIG2 is a schematic diagram of a flow chart of a method for automatically assessing the security of an open source project provided by an embodiment of the present invention;

FIG. 3 schematically shows a structural diagram of an electronic device according to an embodiment of the present invention.

DETAILED DESCRIPTION

The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present invention more thorough and complete, and to fully convey the scope of the present invention to those skilled in the art.

Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, apparatus, method or computer program product. Therefore, the present invention can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

It should be noted that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

Referring to FIG1 below, FIG1 is a flow chart of an open source project security automatic assessment system provided by an embodiment of the present invention. As shown in FIG1 , an open source project security automatic assessment system includes:

A data collection module, used to collect open source data of open source projects, wherein the open source data includes code base, dependency relationships, and update records;

Parameter calculation module, used to obtain security parameters that affect project security based on collected open source data;

A cross-validation module is used to verify the accuracy of security parameters through a cross-calculation method;

A virtual environment simulation module, used to simulate the possibility and fork points of open source projects;

The fork point assessment module is used to conduct security assessments on open source projects by evaluating the security of fork points;

Wherein, the virtual environment simulation module includes:

The environment configuration unit is used to build a virtual environment that simulates the development and operation of open source projects and defines the environment properties through configuration parameter sets;

The fork simulation unit is used to simulate the fork process of open source projects under different conditions and quantify the possibility of forks through fork probabilities;

The risk prediction unit is used to predict the security risks that may arise during the fork process and assess the risk level through risk scoring;

The interactive impact analysis unit is used to generate bifurcation paths and analyze the interactive impact of different bifurcation paths on project security, and quantify the interaction between paths through impact factors.

It should be noted that the automatic security assessment system for open source projects of the present invention first collects data on the target open source project through the data acquisition module. This process involves the comprehensive collection of key information such as the project code base, dependencies, and update records. The collected data will serve as the basis for subsequent evaluations to ensure the comprehensiveness and accuracy of the evaluation.

Subsequently, the parameter calculation module conducts in-depth analysis of the collected open source data to extract key security parameters that affect the project security. These parameters may include but are not limited to vulnerability density, dependency security, and update frequency, which are important indicators for evaluating the security status of the project.

In order to ensure the accuracy of these safety parameters, the cross-validation module uses a cross-calculation method for verification. Through consistency checks, redundancy checks, and anomaly detection, the system can identify and correct possible errors, thereby improving the reliability of the evaluation results.

It should be noted that the bifurcation point in an open source project refers to a specific version or time point where a branch occurs in the project code base. In the present invention, the bifurcation point is not only a branch at the code level, but also a key element of security assessment. By identifying and evaluating the bifurcation point, the potential security risks introduced by the bifurcation can be predicted and quantified.

In the specific implementation, the historical data of the open source project is first collected through the data collection module, including code submission, issue tracking, pull request, etc. Using this data, the system can identify important change points in the project that may indicate future forks. Once potential forks are identified, the system will use the parameter calculation module to analyze the potential impact of these forks on the security of the project. This includes evaluating the new code introduced by the fork, the modified dependencies, and possible configuration changes.

The virtual environment simulation module further simulates the direction of the project after the fork, and simulates the possible development paths after the fork by building different virtual environments. This helps to evaluate the long-term impact of different fork paths on the security of the project.

The bifurcation point assessment module conducts a quantitative assessment of the security of the bifurcation point, including but not limited to security parameters such as vulnerability density, dependency security, and update frequency. These parameters help the system conduct a comprehensive analysis of the security risks of the bifurcation point.

In some embodiments, the purpose of the virtual environment simulation module is to simulate the development and operation of open source projects under controlled conditions in order to evaluate forking behaviors under different conditions and their potential impact on security. The module achieves this goal through a series of units, including an environment configuration unit, a fork simulation unit, a risk prediction unit, and an interaction impact analysis unit.

Specifically, the environment configuration unit is responsible for defining and setting the parameters of the simulation environment, which may include operating system type, programming language, library version, network configuration, etc. The fork simulation unit simulates the process of project forking according to preset conditions or patterns learned from historical data. These conditions may involve specific code changes, community behaviors, or external events. The risk prediction unit evaluates the security risks introduced by forks, and factors may include newly introduced vulnerabilities, security issues of dependencies, or configuration errors. The interaction impact analysis unit analyzes the potential impact of different fork paths on project security, including evaluating the maintenance quality, community response, and problem-solving efficiency of the project after the fork.

Preferably, the environment configuration unit can use automated tools to detect and integrate the required software dependencies, and set up a security sandbox to isolate the simulation environment and the real system. The fork simulation unit can be designed to use machine learning algorithms to predict the conditions under which forks occur, and to train models based on historical data to identify features that lead to unsafe forks. The risk prediction unit can integrate a knowledge base containing security issues found in previous forks to facilitate rapid identification and assessment of potential risks of new forks. More specifically, the interaction impact analysis unit can use graph theory algorithms to model and analyze the interrelationships between fork paths and their impact on the security of the entire project.

In another embodiment, the fork simulation unit can simulate different development scenarios, such as different contributor submission patterns or different code review processes, to evaluate how these factors affect the security of the fork. The risk prediction unit can further include a real-time monitoring system for tracking newly discovered security vulnerabilities and the release of related patches to quickly respond to new security threats. The interaction impact analysis unit can be designed to provide customized reports that highlight the key influencing factors and potential security risks of different fork paths based on the specific needs of project maintainers.

In some embodiments, the virtual environment simulation module includes:

The environment configuration unit is used to build a virtual environment that simulates the development and operation of open source projects and defines the environment properties through configuration parameter sets;

The fork simulation unit is used to simulate the fork process of open source projects under different conditions and quantify the possibility of forks through the fork probability, as shown in formula (1);

(1);

In the formula, is the fork probability; is an environment variable; is the configuration parameter set; is the probability function;

The risk prediction unit is used to predict the security risks that may occur during the forking process and evaluate the risk level through risk scoring, as shown in formula (2);

(2);

In the formula, For project characteristics; is a function for assessing risk based on fork probability and project characteristics;

The interactive impact analysis unit is used to generate bifurcation paths and analyze the interactive impact of different bifurcation paths on project security, and quantify the interaction between paths through impact factors, as shown in calculation formula (3);

(3);

In the formula, is the impact factor; is the probability of the first fork path; is the probability of the second fork path; is the probability of the nth fork path; is a function of the interaction between different fork paths.

It should be noted that the environment configuration unit creates a simulation space similar to the actual development environment to ensure the accuracy and reliability of the simulation results. The unit simulates the development environment of the open source project by integrating the required software and hardware configurations.

Specifically, the unit will define a series of environmental parameters, such as operating system, programming language environment, dependent libraries, etc., and deploy these parameters in isolated virtual machines or containers to simulate the actual operating conditions of the project. Preferably, the environment configuration unit can use automated scripts to quickly deploy and configure the environment, while providing an interface to support the customization of specific environmental requirements of different projects.

The principle of the fork simulation unit is to simulate the fork behavior that may occur in open source projects under certain conditions. By analyzing the project's update history and community dynamics, the scenario of fork occurrence is predicted.

Specifically, the unit collects data such as historical project submission records, issue tracking, and pull requests, and analyzes this data to identify fork patterns and trends.

More specifically, the fork simulation unit can use machine learning techniques to identify patterns that lead to forks, such as a decrease in the activity of code contributors or an increase in the heat of community discussions.

The risk prediction unit predicts potential security risks by analyzing the characteristics of fork points. This involves evaluating the new code introduced by the fork, the modified dependencies, and possible configuration changes. Specifically, the unit performs static and dynamic analysis on the code changes at the fork point to detect potential security vulnerabilities, while also evaluating the security record and update frequency of the dependencies.

Preferably, the risk prediction unit can integrate a real-time updated security vulnerability database and a dependency graph for tracking and managing the security status of project dependencies.

The interactive impact analysis unit evaluates the comprehensive impact of different fork paths on project security. This includes analyzing the community response, code quality, and efficiency of maintenance activities of the project after the fork.

Specifically, the unit simulates multiple forked paths and collects data on community feedback, code submissions, and issue resolution on each path to evaluate their long-term impact on project security.

More specifically, the interaction impact analysis unit can employ network analysis techniques to visualize the interactions of bifurcated paths and community networks, and use quantitative analysis methods to evaluate the security impact of different paths.

Through the above embodiments, the bifurcation point concept of the present invention not only improves the accuracy and efficiency of open source project security assessment, but also provides a new perspective for project maintainers to understand and manage project development and security risks.

In some embodiments, the parameter calculation module includes:

Codebase analysis unit, used to analyze security vulnerabilities and potential risks in the codebase;

Dependency analysis unit, used to evaluate the security of project dependencies and their impact on the security of the main project;

The update record analysis unit is used to monitor and identify update records, and extract the code base and dependency relationships corresponding to the update records.

It should be noted that the code base analysis unit is designed to deeply explore and analyze the project code base to identify potential security vulnerabilities and risk points. By applying static code analysis technology, pattern recognition and machine learning algorithms, the code base analysis unit can efficiently locate possible code defects and security weaknesses.

Furthermore, the dependency analysis unit performs security assessments on external libraries and components that the project depends on. This unit evaluates the potential impact of dependencies on the security of the main project by analyzing their sources, versions, and known security issues. The implementation of the dependency analysis unit helps project maintainers understand and control security risks introduced by improper dependencies.

Preferably, the update record analysis unit focuses on monitoring and identifying the update records of the project. It extracts the code base changes and dependency changes related to these updates by parsing the submission log, change description and version release information. The implementation of the update record analysis unit enables the system to track the latest developments of the project and promptly reflect the impact of the update on the security of the project.

In some embodiments, the parameter calculation module includes: a code base analysis unit for analyzing security vulnerabilities and potential risks in the code base;

Dependency analysis unit, used to evaluate the security of project dependencies and their impact on the security of the main project;

An update record analysis unit, used to monitor and identify update records, and extract code bases and dependencies corresponding to the update records;

Among them, the security vulnerabilities and potential risks in the analysis code base are shown in formula (4);

(4);

In the formula, is the vulnerability density; is the number of vulnerabilities; is the code base size;

The security of project dependencies and their impact on the security of the main project are evaluated as shown in formula (5);

(5);

In the formula, For dependencies Safety score; For dependencies The weight of is the total number of dependencies.

The collaborative work of these three units enables the parameter calculation module to comprehensively evaluate the security of open source projects and provide accurate and reliable security parameters for subsequent cross-validation and security assessment.

In some embodiments, the cross-validation module comprises:

The consistency check unit is used to compare the security parameters calculated from different open source data to ensure the consistency of the results;

A redundancy check unit, used to detect and evaluate the redundancy between safety parameters to enhance the accuracy of the evaluation;

Anomaly detection unit, used to identify abnormal values in security parameters.

It should be noted that the module first compares the safety parameters derived from different data sources or using different analysis methods through a consistency check unit. This process involves comparative analysis of parameter values to ensure their logical and statistical consistency. If significant differences are found between parameters, the system will conduct further review and calibration to eliminate possible sources of error.

Furthermore, the redundancy check unit conducts an in-depth analysis of the security parameter set to identify and evaluate the redundancy between the parameters. In this way, the system can identify those parameters that provide duplicate information, thereby optimizing the parameter set and reducing redundant calculations during the evaluation process.

Preferably, the anomaly detection unit is responsible for identifying outliers in the security parameters. This unit detects those parameter values that deviate significantly from the normal range through statistical analysis and machine learning techniques. Once an anomaly is found, the system will trigger an alarm and conduct in-depth analysis to determine the cause of the anomaly. This may be due to data collection errors, improper analysis methods, or actual security issues.

In some embodiments, the bifurcation point assessment module includes: a safety quantification unit for quantifying the safety risk of the bifurcation point;

Impact Assessment Unit, which is used to assess the impact of forks on the overall security of open source projects;

The risk mitigation advice unit is used to provide risk mitigation measures and recommendations based on the assessment results.

It should be noted that the security quantification unit is responsible for quantifying the security risks of forks, a process that involves detailed analysis and measurement of code changes, newly introduced dependencies, and potential security vulnerabilities introduced by forks. By using quantitative methods such as risk scoring or probability assessment, the unit is able to provide a quantitative security risk indicator for each fork.

Furthermore, the impact assessment unit further analyzes the impact of the fork point on the security of the entire open source project. This unit comprehensively considers the security risks of the fork point and its position and role in the entire project code base, and evaluates its potential impact on the overall security of the project. By conducting qualitative and quantitative analysis of the security impact of the fork point, the unit is able to identify and prioritize the forks that are critical to the security of the project.

Preferably, the risk mitigation suggestion unit provides targeted risk mitigation measures and suggestions based on the assessment results of the first two units. These suggestions may include fixing known security vulnerabilities, updating insecure dependencies, improving the code review process, or enhancing the project's continuous integration and continuous deployment (CI/CD) practices. By providing these practical suggestions, the risk mitigation suggestion unit helps project maintainers take effective measures to reduce the security risks brought by forks and improve the overall security of the project.

In some embodiments, the bifurcation points include: vulnerability bifurcation points, functional bifurcation points, and maintenance bifurcation points. It should be noted that in the open source project security automatic assessment system of the present invention, the bifurcation point assessment module pays special attention to three types of bifurcation points: vulnerability bifurcation points, functional bifurcation points, and maintenance bifurcation points. Vulnerability bifurcation points refer to bifurcation points corresponding to security vulnerabilities caused by code changes or newly introduced dependencies during the project development process. The system conducts in-depth analysis of these bifurcation points through the security quantification unit, identifies potential security vulnerabilities, and performs risk assessment and quantification on them.

Furthermore, functional bifurcation points involve critical moments in the development and change of project functions, which may introduce new functional features or modify existing functions. The assessment of functional bifurcation points needs to consider the security design and implementation of new functions, as well as their compatibility with existing systems and potential security risks. The impact assessment unit will analyze the impact of these bifurcation points on the overall functional safety of the project and evaluate their potential impact on users and systems.

Preferably, maintenance bifurcation points are related to the ongoing maintenance and support of the project, including optimization, refactoring, or performance improvements to existing code. Such bifurcation points may not directly affect functionality, but are critical to the stability and security of the system. The evaluation of maintenance bifurcation points will be completed jointly by the Security Quantification Unit and the Impact Assessment Unit to ensure that maintenance activities do not introduce new security issues while improving the long-term security and maintainability of the system.

Through a detailed assessment of these three types of fork points, the fork point assessment module can comprehensively understand and quantify their impact on the security of open source projects.

In some embodiments, the impact assessment unit includes: a version identification subunit for analyzing the version history of the open source project, identifying bifurcation points in version updates, and determining version changes and differences at these bifurcation points;

Contributor analysis subunit, which is used to evaluate the behavior patterns of contributors related to the fork point and their impact on the security of the project;

The code change detection subunit is used to identify the addition, modification or deletion of code at the fork point;

The dependency tracking subunit is used to track the dependencies introduced by the fork point and evaluate the security of the dependencies.

It should be noted that the impact assessment unit consists of four subunits that work together to comprehensively assess the impact of forks on project security. First, the version identification subunit is responsible for in-depth analysis of the project's version history and accurately identifying forks by comparing the differences between different versions. This subunit determines the exact location of forks and the changes they introduce by recording and analyzing version update logs, commit information, and change sets.

Furthermore, the contributor analysis subunit evaluates the behavioral patterns of contributors associated with the fork point. This subunit evaluates the potential impact of contributors' behaviors on the project security by analyzing their commit history, code review records, and issue tracking activities. By identifying contributors' activity patterns and quality assurance practices, the system can predict and quantify the security risks introduced by specific contributors.

Preferably, the code change detection subunit focuses on identifying specific changes in the code at the fork point, including newly added, modified or deleted code segments. Using code difference analysis technology, the subunit can list in detail all code changes introduced by the fork point, providing necessary information for further security analysis.

Furthermore, the dependency tracking subunit is responsible for tracking all dependencies introduced by the fork point and evaluating the security of these dependencies. By analyzing the source, version, and known security vulnerabilities of the dependencies, the subunit is able to assess their impact on the overall security of the project and identify indirect security risks that may be introduced by the dependencies.

In some embodiments, the security parameters include: vulnerability density parameters, dependency security parameters, and update frequency parameters.

In the open source project security automatic assessment system of the present invention, the selection of security parameters is crucial to the accuracy of the assessment. The system defines three types of core security parameters to comprehensively measure the security status of the project.

It should be noted that the vulnerability density parameter is an indicator that measures the relationship between the number of security vulnerabilities in a project and the size of the code base. By analyzing known and potential security vulnerabilities in the code base, the system calculates the average number of vulnerabilities per thousand lines of code. This parameter helps to quickly identify code areas with concentrated vulnerabilities and provide direction for further security review and repair.

Furthermore, the dependency security parameter evaluates the security of external libraries and components that the project depends on. The system evaluates the impact that these dependencies may have on the security of the main project by checking their version information, known vulnerabilities, and update frequency. High-risk dependencies may reduce the security of the entire project, so this parameter is crucial for identifying and resolving dependency-related security issues.

Preferably, the update frequency parameter reflects the update activity of the project code base. By monitoring the commit frequency and version update cycle of the code base, the system can evaluate the maintenance status of the project. Frequent updates usually mean that the project is being actively maintained, while projects that have not been updated for a long time may have outdated dependencies and unfixed security vulnerabilities.

The above-mentioned embodiments of the present invention have the following beneficial effects: In the present invention, the combination of environment simulation and bifurcation point assessment provides significant advantages for open source project security detection. First, the environment configuration unit provides a real and reliable basis for security assessment by accurately simulating the actual operating environment of the project. This simulation not only includes the operating system and programming language, but also covers dependent libraries and other key environmental factors, ensuring the accuracy of the assessment results.

Furthermore, the fork simulation unit and risk prediction unit use this environment to simulate the fork process of open source projects under different conditions and predict possible security risks. This prediction is based on actual operating conditions and provides a more accurate risk assessment, allowing project maintainers to identify and respond to potential security issues in a timely manner before and after the fork occurs.

In addition, the interactive impact analysis unit further enhances the depth of the assessment by generating bifurcated paths and analyzing the interactive impact of different paths on project security. This enables project maintainers to understand the impact of different decisions on project security and make more accurate decisions.

As shown in FIG. 2 , a method 200 for automatically assessing the security of an open source project in some embodiments includes:

Use the data collection module to collect open source project data including code base, dependencies and update records;

Use the parameter calculation module to calculate the safety parameters that affect the project safety based on the collected data;

Verify the accuracy of the security parameters through the consistency check unit, redundancy check unit and anomaly detection unit of the cross-validation module;

The fork simulation unit of the virtual environment simulation module is used to simulate the fork process of open source projects under different conditions;

Use the risk prediction unit to predict possible security risks that may arise during the fork process;

Quantify the safety risk of the bifurcation point using the safety quantification unit of the bifurcation point assessment module;

Use the Impact Assessment Unit to assess the impact of forks on the overall security of open source projects.

It can be understood that the modules recorded in the open source project security automatic assessment method 200 correspond to the modules, units, etc. in the open source project security automatic assessment system described with reference to FIG1. Therefore, the operations, features, and beneficial effects described above for the open source project security automatic assessment system are also applicable to the open source project security automatic assessment method 200 and the modules contained therein, and will not be repeated here.

Reference is now made to FIG3 , which shows a schematic diagram of a structure 300 of an electronic device suitable for implementing some embodiments of the present invention. The electronic devices in some embodiments of the present invention may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. The terminal device shown in FIG3 is only an example and should not impose any limitations on the functions and scope of use of the embodiments of the present invention.

As shown in FIG3 , the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input/output (I/O) interface 305 is also connected to the bus 304.

Typically, the following devices may be connected to the I/O interface 305: input devices 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although FIG. 3 shows an electronic device 300 with various devices, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively. Each box shown in FIG. 3 may represent one device, or may represent multiple devices as needed.

Furthermore, the storage medium of the embodiment of the present application stores program instructions that can implement all the above methods, wherein the program instructions can be stored in the above storage medium in the form of a software product, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or terminal devices such as a computer, a server, a mobile phone, and a tablet.

The above descriptions are only some preferred embodiments of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present invention is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present invention.

Claims (7)

1. An automatic open source project security assessment system, the system comprising:

The data acquisition module is used for acquiring open source data of an open source project, wherein the open source data comprises a code library, a dependency relationship and an update record;

the parameter calculation module is used for acquiring safety parameters affecting project safety according to the acquired open source data;

the cross verification module is used for verifying the accuracy of the safety parameters through a cross calculation method;

the virtual environment simulation module is used for simulating bifurcation possibility and bifurcation point of the open source project;

the bifurcation point evaluation module is used for evaluating the safety of the bifurcation point to the security evaluation of the open source project;

wherein, the virtual environment simulation module includes:

the environment configuration unit is used for constructing a virtual environment simulating the development and operation of the open source project and defining environment attributes through configuration parameter sets;

the bifurcation simulation unit is used for simulating bifurcation processes of the open source project under different conditions, and quantifying bifurcation possibility through bifurcation probability, as shown in a calculation formula (1);

（1）；

In the formula, Is the bifurcation probability; is an environmental variable; Is a configuration parameter set; is a probability function;

A risk prediction unit for predicting a security risk that may occur in the bifurcation process, and evaluating a risk level by a risk score, as shown in the calculation formula (2);

（2）；

In the formula, Is a project feature; evaluating a risk function based on bifurcation probability and project characteristics;

The interaction influence analysis unit is used for generating branch paths and analyzing interaction influence of different branch paths on project safety, and the interaction among paths is quantified through influence factors, as shown in a calculation formula (3);

（3）；

In the formula, Is an influencing factor; probability of being the 1 st branch path; probability of being the 2 nd branch path; probability of being the nth bifurcation path; A function of interaction effects for different bifurcation paths;

the parameter calculation module comprises: the code library analysis unit is used for analyzing security vulnerabilities and potential risks in the code library;

The dependency relationship analysis unit is used for evaluating the security of project dependency and the influence of the security on the security of the main project;

The updating record analysis unit is used for monitoring and identifying the updating record and extracting a code base and a dependency relationship corresponding to the updating record;

the security hole and the potential risk in the analysis code base are shown in a calculation formula (4);

（4）；

In the formula, Is the density of holes; is the number of vulnerabilities; is the code library size;

evaluating the security of the project dependence and the influence of the security on the security of the main project as shown in a calculation formula (5);

（5）；

In the formula, Is dependent itemIs a safety score of (2); Is dependent item Weights of (2); Is the total number of dependent items;

The cross-validation module includes:

The consistency checking unit is used for comparing the safety parameters calculated by different open source data and ensuring the consistency of the results;

The redundancy checking unit is used for detecting and evaluating redundancy among the safety parameters so as to enhance the accuracy of evaluation;

an anomaly detection unit for identifying an anomaly value in the security parameter;

the bifurcation point evaluation module includes: a security quantifying unit for quantifying a security risk of the bifurcation point;

The influence evaluation unit is used for evaluating the influence of the bifurcation point on the overall safety of the open source project;

and a risk mitigation suggestion unit for providing risk mitigation measures and suggestions based on the evaluation result.

2. The automatic open source item security assessment system of claim 1, wherein the bifurcation comprises: vulnerability bifurcation point, functional bifurcation point, and maintenance bifurcation point.

3. The automatic open source item security assessment system according to claim 2, wherein the impact assessment unit comprises: a version identification subunit for analyzing the version history of the open source item, identifying bifurcation points in version update, and determining version changes and differences of the bifurcation points;

a contributor analysis subunit for evaluating a behavior pattern of the bifurcation point related contributor and an impact of the contributor on project security;

A code change detection subunit, configured to identify a situation of adding, modifying, or deleting a code at a bifurcation point;

And the dependency tracking subunit is used for tracking the dependency items introduced by the bifurcation points and evaluating the security of the dependency items.

4. The automatic open source item security assessment system of claim 1, wherein the security parameters comprise: vulnerability density parameters, security-dependent parameters, update frequency parameters.

5. An automatic evaluation method for the safety of an open source project, which is characterized by comprising the following steps:

Acquiring open source project data comprising a code library, a dependency relationship and an update record by using a data acquisition module;

calculating safety parameters affecting project safety according to the collected data by using a parameter calculation module;

Verifying the accuracy of the safety parameters through a consistency checking unit, a redundancy checking unit and an abnormality detecting unit of the cross verification module;

Simulating bifurcation processes of the open source project under different conditions by using bifurcation simulation units of the virtual environment simulation module;

predicting a security risk which may occur in the bifurcation process using a risk prediction unit;

Quantifying the security risk of the bifurcation point by using a security quantification unit of the bifurcation point evaluation module;

using an influence evaluation unit to evaluate the influence of the bifurcation point on the overall security of the open source project;

wherein calculating security parameters affecting the security of the item includes: analyzing security vulnerabilities and potential risks in the code base;

evaluating the security of the project dependence and the influence of the security on the security of the main project;

Monitoring and identifying an update record, and extracting a code base and a dependency relationship corresponding to the update record;

wherein, the security hole and the potential risk in the analysis code base are shown in a calculation formula (6);

（6）；

In the formula, Is the density of holes; is the number of vulnerabilities; is the code library size;

Evaluating the security of the project dependence and the influence of the security on the security of the main project as shown in a calculation formula (7);

（7）；

In the formula, Is dependent itemIs a safety score of (2); Is dependent item Weights of (2); Is the total number of dependent items;

Wherein verifying the accuracy of the security parameters comprises:

comparing the safety parameters calculated by different open source data to ensure the consistency of the results;

Detecting and evaluating redundancy between the security parameters to enhance accuracy of the evaluation;

identifying outliers in the security parameters;

Wherein, the bifurcation process of the simulated open source project under different conditions comprises: security risk of the safety quantitative bifurcation point;

evaluating the influence of the bifurcation point on the overall safety of the open source project;

providing risk mitigation measures and suggestions based on the evaluation results.

6. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon;

The one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of claims 5.

7. A computer readable storage medium having stored thereon executable instructions which when executed by a processor cause the processor to implement the method of claim 5.