Source tracing method of same source code

Abstract

The invention relates to a source tracing method of a same source code, which comprises the following steps of: establishing a standardized vulnerability knowledge base in a crawler mode, obtaining open source codes meeting specifications, preprocessing open source code results, and storing the preprocessed open source code results; constructing a Neo4j graph database; and carrying out business processing. Therefore, the detection speed can be improved based on the graph library association relationship between the content hash value of the source code and the directory hash value. The problem of full detection of collision between binary files and files is solved, and the speed is increased by more than 10 times, so that engine support is further provided for open source software supply chain security detection. Through multi-dimensional clustering, whether a certain module or a subclass of the module is adopted can be distinguished according to a calculated result score, and the problem that a detection result of a supply chain is inaccurate due to an inclusion relation between open source project modules is solved. More accurate open source items and versions can be provided, so that vulnerability detection in the security industry of the software industry is more accurate.

Description

technical field [0001] The present invention relates to a source tracing method, in particular to a source tracing method of homologous codes. Background technique [0002] With the popularization of the Internet and the rapid development of software, security vulnerabilities are also constantly emerging, resulting in vulnerability information and intelligence agencies, such as Snyk, NVD, CNVD, WhiteSource, blackDuck and other authoritative vulnerability agencies and security vendors. If there are software vulnerabilities, then for the use of the software security supply chain, we usually introduce external dependencies (such as jar packages or certain modules) when we write programs, and other people’s jar packages or modules have a lot of content, and most of them are indirect references, or even There is also a direct use of a part of an open source project for packaging. How to confirm the specific open source software we use is a difficult problem. If we can confirm the...

AI Technical Summary

Problems solved by technology

[0004] However, because the existing technology is a full-scale fingerprint database, every time a file is matched, the bottom layer must perform a full-text search. If the project is large, the search time will be too long

At the same time, this technology has no way to solve the problem of project inclusion relationship (for example: there are multiple modules in the spark program, through the above file detection, multiple projects such as spark-core, sparkStreaming, spark, etc. will be obtained, but the real detection result should be only spark)

Images