Open Source Software Vulnerability Mining Method Based On Knowledge Graph

Open source software development(OSSD)is a kind of software development method based on group wisdom.In this way,developers from different regions participate in the development of open source software projects through the Internet.The rich and diverse open source software library gives great convenience to developers,but the limitation of time,capital,uneven ability level of developers and many other factors also makes open source software vulnerability explosive growth.Traditional software vulnerability mining methods are difficult to support large-scale and multi type software vulnerability mining.Different types of software and difficulty in intuitively expressing software knowledge make developers need to master more and more knowledge in the process of software development and software reuse,which increases the learning cost and the risk of vulnerability.Aiming at the problem of vulnerability mining in open source software,this thesis first used crawler to crawl data from Maven central warehouse and CVE vulnerability knowledge base,constructs an ontology model composed of Git Hub,Maven and CVE,extracts software knowledge based on ontology model,and proposed a parallel entity matcher to complete entity matching task in ontology.Finally,the open source software vulnerability knowledge graph was constructed,which is displayed by neo4 j,and the dependence vulnerability of open source software is analyzed.Based on the obtained vulnerability data,this thesis proposes a vulnerability prediction method based on GCNDT.The thesis built the class dependency graph and member dependency graph of Maven project to obtain the source code features,and embeds the dependency relationship between Maven projects to obtain the structural features.In the experiment,this thesis discussed the influence of the data scale and the number of layers of the drawing machine on the model,evaluates the model with five indexes,and compares it with the other three models.The experimental results verify the accuracy and effectiveness of the method.