CN116361748B - Software supply chain safety detection method and device - Google Patents
Software supply chain safety detection method and device Download PDFInfo
- Publication number
- CN116361748B CN116361748B CN202310345130.8A CN202310345130A CN116361748B CN 116361748 B CN116361748 B CN 116361748B CN 202310345130 A CN202310345130 A CN 202310345130A CN 116361748 B CN116361748 B CN 116361748B
- Authority
- CN
- China
- Prior art keywords
- target
- open source
- protocol
- website
- software
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 35
- 238000012544 monitoring process Methods 0.000 claims abstract description 45
- 238000000034 method Methods 0.000 claims abstract description 37
- 238000011161 development Methods 0.000 claims abstract description 28
- 230000004048 modification Effects 0.000 claims description 17
- 238000012986 modification Methods 0.000 claims description 17
- 230000002159 abnormal effect Effects 0.000 claims description 16
- 230000004044 response Effects 0.000 claims description 15
- 238000004590 computer program Methods 0.000 claims description 7
- 230000002940 repellent Effects 0.000 claims description 3
- 239000005871 repellent Substances 0.000 claims description 3
- 241000700605 Viruses Species 0.000 abstract description 4
- 230000006870 function Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000004891 communication Methods 0.000 description 2
- 230000001419 dependent effect Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
- G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
Abstract
The application discloses a method and a device for detecting the safety of a software supply chain, which are used for responding to a development safety detection instruction and entering a monitoring mode, when the operation of copying/downloading target content carrying an open source code is monitored, a source website of the target content is timely acquired, and under the condition that the source website is unsafe, the corresponding target content is timely deleted, so that the target content is prevented from being applied to a development interface. The method can avoid the software developer from copying/downloading the open source code which possibly has the malicious hidden trouble of viruses and the like from unreliable websites such as an unofficial hosting place and the like, and ensures the safety of the software development. Software developers can trigger the development of security detection instructions for the purpose of security monitoring of the code they are compiling, by executing the computer itself to assist in monitoring whether the code they compile is secure.
Description
Technical Field
The present application relates to the field of network security technologies, and in particular, to a method and an apparatus for detecting security of a software supply chain.
Background
For general software, a user can only obtain a binary executable file which is compiled, and usually only an author or a copyright owner of the software or the like owns source code of a program. Whereas open source software refers to computer software that is open to source code and allows anyone to learn, copy, modify, and reissue.
Modern software development is increasingly dependent on open source software, and layer-by-layer multiplexing of open source third party libraries makes downstream software developers unable to know upstream software dependencies clearly. Opaque software upstream dependencies can lead to uncontrollable software supply chain risks.
In addition, depending on the open source protocol under which the various open source codes are based, developers often invest in software development and neglect the risk of being involved in the open source protocol due to improper use of the open source code.
Disclosure of Invention
The application aims to provide a software supply chain safety detection method and device, which can improve the problems.
Embodiments of the present application are implemented as follows:
in a first aspect, the present application provides a software supply chain security detection method, comprising:
s1, responding to a development security detection instruction, and monitoring a current display page;
s2, under the condition that the current display page is monitored to be a webpage, responding to an acquisition instruction aiming at target content on the current display page, and acquiring the target content and a current website of the webpage;
s3, searching the current website in a safe website database;
and S4, deleting the obtained target content under the condition that the current website is not found in the safe website database.
In the present application, S1, S2, S3..and the like are only step numbers, the order of execution is not limited, the step with the larger number may be performed first or may be performed later, for example, step S2 may be understood as being performed after step S3.
It can be appreciated that the application discloses a software supply chain security detection method, which responds to a security detection instruction and enters a monitoring mode, when the operation of copying/downloading the target content carrying the open source code is monitored, the source website of the target content is timely obtained, and under the condition that the source website is unsafe, the corresponding target content is timely deleted, so that the target content is prevented from being applied to a development interface. The method can avoid the software developer from copying/downloading the open source code which possibly has the malicious hidden trouble of viruses and the like from unreliable websites such as an unofficial hosting place and the like, and ensures the safety of the software development. Software developers can trigger the development of security detection instructions for the purpose of security monitoring of the code they are compiling, by executing the computer itself to assist in monitoring whether the code they compile is secure.
In an alternative embodiment of the present application, step S2 includes at least one of:
when the current display page is monitored to be a webpage, copying a target open source code to a clipboard in response to a copying instruction aiming at the target open source code on the current display page, and acquiring a current website of the webpage;
and under the condition that the current display page is a webpage, responding to a downloading instruction of a target file containing a target open source code on the current display page, downloading the target file to a local database and acquiring a current website of the webpage.
Correspondingly, the "deleting the obtained target content" in step S4 includes at least one of the following:
deleting the target open source code from the clipboard;
and deleting the target file from the local database.
It can be understood that modern software development depends on open source software more and more, when compiling software codes, software developers often obtain required target open source codes from other websites, and the obtaining mode can be direct copy and paste of the target open source codes, or downloading of a target file containing the target open source codes, and then inserting the target file into a development page.
In an alternative embodiment of the present application, the method further comprises:
s5, under the condition that the current display page is monitored to be a webpage, responding to an acquisition instruction aiming at target content on the current display page, acquiring a protocol keyword in the webpage, and determining a corresponding target open source protocol according to the open source protocol keyword;
the secure website database comprises at least one secure website sub-database, each secure website sub-database corresponds to an open source protocol, and step S3 comprises:
searching the current website in the secure website sub-library corresponding to the target open source protocol.
It can be understood that the secure website database is a local database, in which various secure and reliable source websites of the source codes are stored, and in order to determine whether the source websites of the target content carrying the target source codes are reliable, the computer needs to search the entire secure website database for the source websites, so that the calculation amount is too large. Therefore, the security website database can be classified according to the open source protocol to obtain a plurality of security website sub-libraries, and each security website sub-library only stores the security source websites corresponding to a single open source protocol. After the target open source protocol corresponding to the target content is obtained, the current source website can be searched in the corresponding safe website sub-library only according to the target open source protocol, so that the query time is greatly reduced, and the query efficiency is improved.
In an alternative embodiment of the present application, the method further comprises:
s6, under the condition that the current display page is monitored to be a development page, responding to the input operation of the target content, and starting an interface name monitoring mode;
and S7, in the interface name monitoring mode, responding to the input operation of the target abnormal interface name which is repulsed with the target open source protocol, and displaying warning information.
The step S7 specifically includes:
s71, in the interface name monitoring mode, monitoring the input content of the development page;
s72, searching an abnormal interface name database corresponding to the target open source protocol and repellent to the abnormal interface name database;
and S73, displaying warning information under the condition that the input content is found in the abnormal interface name database.
It will be appreciated that some powerful clients or suppliers, in order to avoid their software being sourced, agree in both parties' agreements that their software must not be placed at risk of being sourced, if violated, the unit in which the software developer resides will reimburse the high loss. Therefore, in response to the input operation of the target content, the interface name monitoring mode should be started to monitor whether the developer calls the target abnormal interface name which is repulsed from the target open source protocol, so that contract disputes of the response are avoided for the software developer.
In an alternative embodiment of the present application, the method further comprises:
s8, under the condition that the current display page is monitored to be a development page, responding to the input operation of the target content, and acquiring the target open source protocol;
s9, under the condition that the target open source protocol is a harsh protocol, starting a modification monitoring mode; and/or displaying a protocol icon corresponding to the loose protocol when the target open source protocol is the loose protocol;
and S10, in the modification monitoring mode, responding to modification operation of the development page aiming at the target content, and displaying prompt information corresponding to the harsh protocol.
It is understood that open source software refers to computer software that is open to source code and allows anyone to learn, copy, modify, reissue, but each has its own unique protocol requirements, and some open source protocols have their own special requirements for the modified portion of code, e.g., mozilia protocol requires that a description document be provided where the source code is modified, etc. Therefore, under the condition that the target open source protocol is a severe protocol, a modification monitoring mode needs to be started, and when modification operation on target content is monitored, relevant prompt information is displayed in time, so that developers are prompted to follow the protocol requirements.
In a second aspect, the present application provides a software supply chain safety detection apparatus comprising a processor, an input device, an output device and a memory, the processor, the input device, the output device and the memory being interconnected, wherein the memory is for storing a computer program comprising program instructions, the processor being configured to invoke the program instructions to perform the method of any of the first aspects.
In a third aspect, the present application discloses a computer readable storage medium storing a computer program comprising program instructions which, when executed by a processor, cause the processor to perform the method according to any of the first aspects.
The beneficial effects are that:
the application discloses a software supply chain safety detection method, which responds to a development safety detection instruction and then enters a monitoring mode, when the operation of copying/downloading target content carrying an open source code is monitored, a source website of the target content is timely obtained, and under the condition that the source website is unsafe, the corresponding target content is timely deleted, so that the target content is prevented from being applied to a development interface. The method can avoid the software developer from copying/downloading the open source code which possibly has the malicious hidden trouble of viruses and the like from unreliable websites such as an unofficial hosting place and the like, and ensures the safety of the software development. Software developers can trigger the development of security detection instructions for the purpose of security monitoring of the code they are compiling, by executing the computer itself to assist in monitoring whether the code they compile is secure.
Some powerful clients or suppliers agree in the two-party agreement that their software must not be placed at risk of being sourced in order to avoid that it is sourced, and if violated, the unit in which the software developer resides will be reimbursed for high losses. Therefore, in response to the input operation of the target content, the interface name monitoring mode should be started to monitor whether the developer calls the target abnormal interface name which is repulsed from the target open source protocol, so that contract disputes of the response are avoided for the software developer.
Open source software refers to computer software that is open to source code and allows anyone to learn, copy, modify, reissue, but each open source protocol has its own unique protocol requirements, and some open source protocols have their own special requirements for the modified portion of code, e.g., mozilia protocol requires that a description document be provided where the source code is modified, etc. Therefore, under the condition that the target open source protocol is a severe protocol, a modification monitoring mode needs to be started, and when modification operation on target content is monitored, relevant prompt information is displayed in time, so that developers are prompted to follow the protocol requirements.
In order to make the above objects, features and advantages of the present application more comprehensible, alternative embodiments accompanied with figures are described in detail below.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic flow chart of a software supply chain security detection method provided by the application;
FIG. 2 is a schematic diagram of a target content acquisition method according to the present application;
FIG. 3 is a schematic diagram of a monitoring status of an interface name monitoring mode according to the present application;
fig. 4 is a schematic structural diagram of a software supply chain safety detection device provided by the application.
Detailed Description
The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
In a first aspect, the present application provides a software supply chain security detection method, comprising:
s1, responding to a development security detection instruction, and monitoring a current display page.
Modern software development is increasingly dependent on open source software, and layer-by-layer multiplexing of open source third party libraries makes downstream software developers unable to know upstream software dependencies, which can lead to uncontrollable software supply chain risks. Software developers often focus on the development work of software in the process of developing the software, and neglect the legality of the software code. Therefore, in the software supply chain safety detection method provided by the application, a software developer can trigger a safety detection instruction to assist in monitoring whether the self-compiled code is safe or not by executing the computer when safety monitoring is required.
S2, under the condition that the current display page is monitored to be a webpage, responding to an acquisition instruction aiming at target content on the current display page, and acquiring the target content and a current website of the webpage.
In an alternative embodiment of the present application, step S2 includes at least one of:
when the current display page is monitored to be a webpage, copying a target open source code to a clipboard in response to a copying instruction aiming at the target open source code on the current display page, and acquiring a current website of the webpage;
and under the condition that the current display page is a webpage, responding to a downloading instruction of a target file containing a target open source code on the current display page, downloading the target file to a local database and acquiring the current website of the webpage.
It can be understood that modern software development relies on open source software more and more, when compiling software code, a software developer often obtains the required target open source code from other websites, and the obtaining mode may be direct copy and paste of the target open source code, as shown in fig. 1, or may be downloading a target file containing the target open source code, and then inserting the target file into a development page.
S3, searching the current website in the safe website database.
The safe website database is a local database, in which various safe and reliable source websites of the source codes are stored, and in order to judge whether the source websites of the target contents carrying the target source codes are reliable, the computer needs to search the source websites in the whole safe website database.
If the current website exists in the safe website database, the current website is safe and reliable, and the corresponding target content source is legal; if the current website does not exist in the safe website database, the current website is unsafe, and the corresponding target content source is dangerous.
The secure website database comprises at least one secure website sub-library, each secure website sub-library corresponds to an open source protocol, and step S3 comprises: searching a current website in a safe website sub-library corresponding to the target open source protocol.
It will be appreciated that searching the source web site across the secure web site database is computationally expensive. Therefore, the security website database can be classified according to the open source protocol to obtain a plurality of security website sub-libraries, and each security website sub-library only stores the security source websites corresponding to a single open source protocol. After the target open source protocol corresponding to the target content is obtained, the current source website can be searched in the corresponding safe website sub-library only according to the target open source protocol, so that the query time is greatly reduced, and the query efficiency is improved.
And S4, deleting the obtained target content under the condition that the current website is not found in the safe website database.
In the present application, S1, S2, S3..and the like are only step numbers, the order of execution is not limited, the step with the larger number may be performed first or may be performed later, for example, step S2 may be understood as being performed after step S3.
Correspondingly, the "deleting the obtained target content" in step S4 includes at least one of the following:
deleting the target open source code from the clipboard;
and deleting the target file from the local database.
It can be appreciated that the application discloses a software supply chain security detection method, which responds to a security detection instruction and enters a monitoring mode, when the operation of copying/downloading the target content carrying the open source code is monitored, the source website of the target content is timely obtained, and under the condition that the source website is unsafe, the corresponding target content is timely deleted, so that the target content is prevented from being applied to a development interface. The method can avoid the software developer from copying/downloading the open source code which possibly has the malicious hidden trouble of viruses and the like from unreliable websites such as an unofficial hosting place and the like, and ensures the safety of the software development. Software developers can trigger the development of security detection instructions for the purpose of security monitoring of the code they are compiling, by executing the computer itself to assist in monitoring whether the code they compile is secure.
In an alternative embodiment of the application, the method further comprises:
and S6, under the condition that the current display page is monitored to be a development page, responding to the input operation of the target content, and starting an interface name monitoring mode.
Some powerful clients or suppliers agree in the two-party agreement that their software must not be placed at risk of being sourced in order to avoid that it is sourced, and if violated, the unit in which the software developer resides will be reimbursed for high losses. For example, after a developer uses the open source code of a severe open source protocol, the provider or customer software interface is called again in the same software code, so that the software also has to be open source in the future, and contract disputes with the provider or customer are caused. Therefore, in response to an input operation of the target content, the interface name monitoring mode should be turned on.
And S7, in the interface name monitoring mode, responding to the input operation of the abnormal interface name of the target which is repulsed with the open source protocol of the target, and displaying warning information.
As shown in fig. 2, when the developer is monitored to input the interface name "IShape", immediately judging whether the interface name "IShape" is repulsive to the target open source protocol, and if the interface name "IShape" is repulsive to the target open source protocol, displaying warning information.
The step S7 specifically includes:
and S71, in the interface name monitoring mode, monitoring the input content of the development page.
S72, searching an abnormal interface name database corresponding to the target open source protocol and repellent to the abnormal interface name database.
And S73, displaying warning information when the input content is found in the abnormal interface name database.
It will be appreciated that some powerful clients or suppliers, in order to avoid their software being sourced, agree in both parties' agreements that their software must not be placed at risk of being sourced, if violated, the unit in which the software developer resides will reimburse the high loss. Therefore, in response to the input operation of the target content, the interface name monitoring mode should be started to monitor whether the developer calls the target abnormal interface name which is repulsed from the target open source protocol, so that contract disputes of the response are avoided for the software developer.
In an alternative embodiment of the application, the method further comprises:
and S8, under the condition that the current display page is the development page, responding to the input operation of the target content, and acquiring the target open source protocol.
And S9, under the condition that the target open source protocol is a harsh protocol, starting a modification monitoring mode. And/or displaying a protocol icon corresponding to the loose protocol in the case that the target open source protocol is the loose protocol.
And S10, under the modification monitoring mode, responding to modification operation aiming at target content on the development page, and displaying prompt information corresponding to a harsh protocol.
It is understood that open source software refers to computer software that is open to source code and allows anyone to learn, copy, modify, reissue, but each has its own unique protocol requirements, and some open source protocols have their own special requirements for the modified portion of code, e.g., mozilia protocol requires that a description document be provided where the source code is modified, etc. Therefore, under the condition that the target open source protocol is a severe protocol, a modification monitoring mode needs to be started, and when modification operation on target content is monitored, relevant prompt information is displayed in time, so that developers are prompted to follow the protocol requirements.
In a second aspect, the present application provides a software supply chain security detection device. As shown in fig. 4, the software supply chain security detection device includes one or more processors 401; one or more input devices 402, one or more output devices 403, and a memory 404. The processor 401, the input device 402, the output device 403, and the memory 404 are connected by a bus 405. The memory 404 is used for storing a computer program comprising program instructions, and the processor 401 is used for executing the program instructions stored in the memory 404. Wherein the processor 401 is configured to invoke the program instructions to perform the operations of any of the methods of the first aspect:
it should be appreciated that in embodiments of the application, the processor 401 may be a central processing unit (CentralProcessingUnit, CPU), which may also be other general purpose processors, digital signal processors (DigitalSignalProcessor, DSP), application specific integrated circuits (ApplicationSpecificIntegratedCircuit, ASIC), off-the-shelf programmable gate arrays (Field-ProgrammableGateArray, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The input device 402 may include a keyboard, a mouse, a touch pad, a fingerprint sensor (for collecting fingerprint information of a user and direction information of a fingerprint), a microphone, etc., and the output device 403 may include a display (LCD, etc.), a speaker, etc.
The memory 404 may include read only memory and random access memory and provide instructions and data to the processor 401. A portion of memory 404 may also include non-volatile random access memory. For example, memory 404 may also store information of device type.
In a specific implementation, the processor 401, the input device 402, and the output device 403 described in the embodiments of the present application may perform an implementation described by any of the methods of the first aspect, and may also perform an implementation of the terminal device described in the embodiments of the present application, which is not described herein again.
In a third aspect, the present application provides a computer readable storage medium storing a computer program comprising program instructions which when executed by a processor implement the steps of any of the methods of the first aspect.
The computer readable storage medium may be an internal storage unit of the terminal device of any of the foregoing embodiments, for example, a hard disk or a memory of the terminal device. The computer readable storage medium may be an external storage device of the terminal device, for example, a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash memory card (FlashCard), or the like, which are provided in the terminal device. Further, the computer-readable storage medium may further include both an internal storage unit and an external storage device of the terminal device. The computer-readable storage medium is used for storing the computer program and other programs and data required by the terminal device. The above-described computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.
Those of ordinary skill in the art will appreciate that the elements and algorithm steps described in connection with the embodiments disclosed herein may be embodied in electronic hardware, in computer software, or in a combination of the two, and that the elements and steps of the examples have been generally described in terms of function in the foregoing description to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
In several embodiments provided in the present application, it should be understood that the disclosed terminal device and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the above-described division of units is merely a logical function division, and there may be another division manner in actual implementation, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. In addition, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices, or elements, or may be an electrical, mechanical, or other form of connection.
The units described above as separate components may or may not be physically separate, and components shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment of the present application.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units described above, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application is essentially or a part contributing to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method in the various embodiments of the present application. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a Read-only memory (ROM), a random access memory (RAM, randomAccessMemory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
The terms "first," "second," "the first," or "the second," as used in various embodiments of the present disclosure, may modify various components without regard to order and/or importance, but these terms do not limit the corresponding components. The above description is only configured for the purpose of distinguishing an element from other elements. For example, the first user device and the second user device represent different user devices, although both are user devices. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of the present disclosure.
When an element (e.g., a first element) is referred to as being "coupled" (operatively or communicatively) to "another element (e.g., a second element) or" connected "to another element (e.g., a second element), it is understood that the one element is directly connected to the other element or the one element is indirectly connected to the other element via yet another element (e.g., a third element). In contrast, it will be understood that when an element (e.g., a first element) is referred to as being "directly connected" or "directly coupled" to another element (a second element), then no element (e.g., a third element) is interposed therebetween.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, the element defined by the phrase "comprising one … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element, and furthermore, elements having the same name in different embodiments of the application may have the same meaning or may have different meanings, the particular meaning of which is to be determined by its interpretation in this particular embodiment or by further combining the context of this particular embodiment.
The above description is only of alternative embodiments of the application and of illustrations of the technical principles applied. It will be appreciated by persons skilled in the art that the scope of the application referred to in the present application is not limited to the specific combinations of the technical features described above, but also covers other technical features formed by any combination of the technical features described above or their equivalents without departing from the inventive concept described above. Such as the above-mentioned features and the technical features disclosed in the present application (but not limited to) having similar functions are replaced with each other.
The words "if", as used herein, may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to a detection", depending on the context. Similarly, the phrase "if determined" or "if detected (stated condition or event)" may be interpreted as "when determined" or "in response to determination" or "when detected (stated condition or event)" or "in response to detection (stated condition or event), depending on the context.
The above description is only of alternative embodiments of the application and of illustrations of the technical principles applied. It will be appreciated by persons skilled in the art that the scope of the application referred to in the present application is not limited to the specific combinations of the technical features described above, but also covers other technical features formed by any combination of the technical features described above or their equivalents without departing from the inventive concept described above. Such as the above-mentioned features and the technical features disclosed in the present application (but not limited to) having similar functions are replaced with each other.
The above description is only of alternative embodiments of the present application and is not intended to limit the present application, and various modifications and variations will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.
Claims (9)
1. A software supply chain security detection method, comprising:
responding to a development security detection instruction, and monitoring a current display page;
under the condition that the current display page is a webpage, responding to an acquisition instruction aiming at target content on the current display page, and acquiring the target content and a current website of the webpage;
searching the current website in a safe website database;
deleting the obtained target content under the condition that the current website is not found in the safe website database;
the method further comprises the steps of:
under the condition that the current display page is a webpage, responding to an acquisition instruction aiming at target content on the current display page, acquiring a protocol keyword in the webpage, and determining a corresponding target open source protocol according to the protocol keyword;
the secure website database comprises at least one secure website sub-database, each secure website sub-database corresponds to an open source protocol, and the searching of the current website in the secure website database comprises the following steps:
searching the current website in the secure website sub-library corresponding to the target open source protocol.
2. The software supply chain security detection method of claim 1, wherein the obtaining the target content and the current web address of the web page in response to the obtaining instruction for the target content on the current display page comprises at least one of:
copying the target open source code to a clipboard in response to a copying instruction aiming at the target open source code on the current display page, and acquiring the current website of the webpage;
and responding to a downloading instruction for a target file containing a target open source code on the current display page, downloading the target file to a local database and acquiring the current website of the webpage.
3. The method for software supply chain security detection according to claim 2, wherein,
the deleting the acquired target content comprises at least one of the following:
deleting the target open source code from the clipboard;
and deleting the target file from the local database.
4. The method for software supply chain security detection as recited in claim 1, wherein,
the method further comprises the steps of:
under the condition that the current display page is a development page, responding to the input operation of the target content, and starting an interface name monitoring mode;
and in the interface name monitoring mode, responding to the input operation of the abnormal interface name of the target which is repulsed with the open source protocol of the target, and displaying warning information.
5. The method for software supply chain security detection as recited in claim 4, wherein,
in the interface name monitoring mode, responding to the input operation of the target abnormal interface name which is repulsed with the target open source protocol, displaying warning information, and comprising the following steps:
monitoring the input content of the development page in the interface name monitoring mode;
searching an abnormal interface name database corresponding to the target open source protocol and repellent to the abnormal interface name database;
and displaying warning information under the condition that the input content is found in the abnormal interface name sub-library.
6. The method for software supply chain security detection as recited in claim 1, wherein,
the method further comprises the steps of:
under the condition that the current display page is a development page, responding to the input operation of the target content, and acquiring the target open source protocol;
under the condition that the target open source protocol is a harsh protocol, starting a modification monitoring mode;
and in the modification monitoring mode, responding to modification operation on the development page aiming at the target content, and displaying prompt information corresponding to the harsh protocol.
7. The method of claim 6, wherein,
the method further comprises the steps of:
and displaying a protocol icon corresponding to the loose protocol under the condition that the target open source protocol is the loose protocol.
8. A software supply chain safety detection device is characterized in that,
comprising a processor, an input device, an output device and a memory, the processor, the input device, the output device and the memory being interconnected, wherein the memory is adapted to store a computer program comprising program instructions, the processor being configured to invoke the program instructions to perform the method of any of claims 1 to 7.
9. A computer-readable storage medium comprising,
the computer storage medium stores a computer program comprising program instructions which, when executed by a processor, cause the processor to perform the method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310345130.8A CN116361748B (en) | 2023-04-03 | 2023-04-03 | Software supply chain safety detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310345130.8A CN116361748B (en) | 2023-04-03 | 2023-04-03 | Software supply chain safety detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116361748A CN116361748A (en) | 2023-06-30 |
| CN116361748B true CN116361748B (en) | 2023-09-15 |
Family
ID=86923630
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310345130.8A Active CN116361748B (en) | 2023-04-03 | 2023-04-03 | Software supply chain safety detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116361748B (en) |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA2358531A1 (en) * | 1999-01-15 | 2000-07-20 | Gillis E. Onyeabor | Method and system for database-driven, scalable web page development, deployment-download, and execution |
| CN102419808A (en) * | 2011-09-28 | 2012-04-18 | 奇智软件（北京）有限公司 | Method, device and system for detecting safety of download link |
| CN103839002A (en) * | 2012-11-21 | 2014-06-04 | 腾讯科技（深圳）有限公司 | Website source code malicious link injection monitoring method and device |
| CN105138917A (en) * | 2015-08-26 | 2015-12-09 | 成都秋雷科技有限责任公司 | Malicious webpage defending method |
| WO2016011879A1 (en) * | 2014-07-24 | 2016-01-28 | 广州市动景计算机科技有限公司 | Web page display method and apparatus |
| CN107480520A (en) * | 2017-08-14 | 2017-12-15 | 王春华 | The method and system that a kind of web page contents are downloaded |
| CN108881608A (en) * | 2018-04-26 | 2018-11-23 | Oppo广东移动通信有限公司 | Web data screen method, device and mobile terminal |
| CN109471639A (en) * | 2017-09-06 | 2019-03-15 | 北京国双科技有限公司 | The monitoring method and device in a kind of application downloading source |
| CN110213211A (en) * | 2018-05-22 | 2019-09-06 | 腾讯科技（深圳）有限公司 | Identify the method, apparatus, terminal and storage medium of safe download link |
| CN111177519A (en) * | 2019-12-30 | 2020-05-19 | 广州市百果园网络科技有限公司 | Webpage content acquisition method and device, storage medium and equipment |
| CN111241439A (en) * | 2018-11-29 | 2020-06-05 | 北京京东尚科信息技术有限公司 | Method and device for copying webpage content, electronic equipment and medium |
| EP3709200A1 (en) * | 2019-03-14 | 2020-09-16 | BlackBerry Limited | Determining security risks in binary software code based on network protocols |
| CN111782991A (en) * | 2020-07-15 | 2020-10-16 | 浙江军盾信息科技有限公司 | Method, device, equipment and storage medium for detecting abnormal hidden link of website |
| CN115659974A (en) * | 2022-09-30 | 2023-01-31 | 中国科学院软件研究所 | Software security public opinion event extraction method and device based on open source software supply chain |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10324826B2 (en) * | 2013-02-12 | 2019-06-18 | Focus IP Inc. | Developer channel compliance |
-
2023
- 2023-04-03 CN CN202310345130.8A patent/CN116361748B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA2358531A1 (en) * | 1999-01-15 | 2000-07-20 | Gillis E. Onyeabor | Method and system for database-driven, scalable web page development, deployment-download, and execution |
| CN102419808A (en) * | 2011-09-28 | 2012-04-18 | 奇智软件（北京）有限公司 | Method, device and system for detecting safety of download link |
| CN103839002A (en) * | 2012-11-21 | 2014-06-04 | 腾讯科技（深圳）有限公司 | Website source code malicious link injection monitoring method and device |
| WO2016011879A1 (en) * | 2014-07-24 | 2016-01-28 | 广州市动景计算机科技有限公司 | Web page display method and apparatus |
| CN105138917A (en) * | 2015-08-26 | 2015-12-09 | 成都秋雷科技有限责任公司 | Malicious webpage defending method |
| CN107480520A (en) * | 2017-08-14 | 2017-12-15 | 王春华 | The method and system that a kind of web page contents are downloaded |
| CN109471639A (en) * | 2017-09-06 | 2019-03-15 | 北京国双科技有限公司 | The monitoring method and device in a kind of application downloading source |
| CN108881608A (en) * | 2018-04-26 | 2018-11-23 | Oppo广东移动通信有限公司 | Web data screen method, device and mobile terminal |
| CN110213211A (en) * | 2018-05-22 | 2019-09-06 | 腾讯科技（深圳）有限公司 | Identify the method, apparatus, terminal and storage medium of safe download link |
| CN111241439A (en) * | 2018-11-29 | 2020-06-05 | 北京京东尚科信息技术有限公司 | Method and device for copying webpage content, electronic equipment and medium |
| EP3709200A1 (en) * | 2019-03-14 | 2020-09-16 | BlackBerry Limited | Determining security risks in binary software code based on network protocols |
| CN111177519A (en) * | 2019-12-30 | 2020-05-19 | 广州市百果园网络科技有限公司 | Webpage content acquisition method and device, storage medium and equipment |
| CN111782991A (en) * | 2020-07-15 | 2020-10-16 | 浙江军盾信息科技有限公司 | Method, device, equipment and storage medium for detecting abnormal hidden link of website |
| CN115659974A (en) * | 2022-09-30 | 2023-01-31 | 中国科学院软件研究所 | Software security public opinion event extraction method and device based on open source software supply chain |
Non-Patent Citations (2)
| Title |
|---|
| 崔宝江 ; .软件供应链安全面临软件开源化的挑战.中国信息安全.2018,(第11期),全文. * |
| 软件供应链安全面临软件开源化的挑战;崔宝江;;中国信息安全(第11期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116361748A (en) | 2023-06-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Pandita et al. | {WHYPER}: Towards automating risk assessment of mobile applications | |
| Wassermann et al. | Sound and precise analysis of web applications for injection vulnerabilities | |
| US20070271617A1 (en) | Vulnerability check program, vulnerability check apparatus, and vulnerability check method | |
| JP5507699B2 (en) | Malignant site detection apparatus and method | |
| US8838964B2 (en) | Package audit tool | |
| JP6952506B2 (en) | Inspection equipment | |
| US8676768B1 (en) | Collaborative modeling environment | |
| CN111737692B (en) | Application program risk detection method and device, equipment and storage medium | |
| CN111967017B (en) | Method, device, terminal equipment and storage medium for generating dependency relationship | |
| Huang et al. | Detecting sensitive data disclosure via bi-directional text correlation analysis | |
| CN108769070A (en) | One kind is gone beyond one's commission leak detection method and device | |
| CN116361748B (en) | Software supply chain safety detection method and device | |
| CN111290747B (en) | Method, system, equipment and medium for creating function hook | |
| CN114662097A (en) | CSV file injection attack detection method and device, electronic equipment and storage medium | |
| CN113935847A (en) | Online process risk processing method, device, server and medium | |
| US11722324B2 (en) | Secure and accountable execution of robotic process automation | |
| CN113129004A (en) | Transaction security detection method and device | |
| CN103136474A (en) | Method and device for detecting files | |
| US9542182B2 (en) | Standardization of variable names in an integrated development environment | |
| JP2013030017A (en) | Method, device, and program for generating test program | |
| CN113467815A (en) | Application repair method and device for hot update, terminal equipment and storage medium | |
| CN111966630B (en) | File type detection method, device, equipment and medium | |
| CN111752570A (en) | Compiling method, device, terminal and computer readable storage medium | |
| CN111027073B (en) | Vulnerability detection method, device, equipment and storage medium | |
| CN113344549B (en) | Project engineering document updating method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |