夜雨聆风
分享兴趣，传播快乐，
增长见闻，留下美好！
亲爱的您，这里是LearningYard学苑。
今天小编为大家带来
“颜读（150）：精读期刊论文《开源软件供应链漏洞威胁智能感知》研究对象和关键词定义”
欢迎您的访问！
Share interest, spread happiness,
increase knowledge, and leave beautiful.
Dear, this is the LearningYard Academy!
Today, the editor brings the
“Yan Du (150): In-depth reading of the journal paper ‘Intelligent Perception of Vulnerability Threats in the Open Source Software Supply Chain’—Definitions of research subjects and keywords”
Welcome to visit!
今天小编将从思维导图、精读内容、知识补充三个板块为大家带来《开源软件供应链漏洞威胁智能感知》研究对象和关键词定义的介绍。
Today, the editor will introduce the research objects and keyword definitions of "Intelligent Perception of Open Source Software Supply Chain Vulnerabilities and Threats" from three sections: mind mapping, intensive reading content, and knowledge supplement.
一、思维导图（Mind Mapping）
二、精读内容（Conduct in-depth reading of the material）
1.研究对象（Subjects of the study）
本文的研究对象是开源软件供应链，开源软件供应链是指由开源软件开发、发布、分发、使用过程中涉及的各种实体及其依赖关系构成的网络系统。本文以开源软件供应链为研究对象，通过特征表示技术构建知识图谱，实现漏洞威胁感知，并最终完成风险推送与预警。
This paper focuses on the open-source software supply chain—a network system comprising the various entities and their interdependencies involved in the development, release, distribution, and use of open-source software. Centered on this subject, the study employs feature representation techniques to construct a knowledge graph, enables the detection of vulnerability threats, and ultimately facilitates risk notification and early warning.
2.关键词定义（Definition of Keywords）
（1）漏洞威胁感知（Vulnerability Threat Awareness）
漏洞威胁感知是指通过收集、分析和关联安全漏洞信息、威胁情报及攻击行为信息，实现对漏洞风险的发现、识别、预测和预警的过程。
Vulnerability threat awareness refers to the process of discovering, identifying, predicting, and issuing early warnings regarding vulnerability risks by collecting, analyzing, and correlating information on security vulnerabilities, threat intelligence, and attack behaviors.
（2）特征表示（Feature representation）
特征表示是指利用数学向量或深度学习模型，将文本、实体或知识转换为计算机能够理解和处理的数字表示形式。在本文中，作者利用SecERNIE模型对漏洞描述、攻击技术描述等文本进行语义表示。
Feature representation refers to the use of mathematical vectors or deep learning models to convert text, entities, or knowledge into numerical representations that computers can understand and process. In this paper, the authors employ the SecERNIE model to generate semantic representations for texts such as vulnerability descriptions and attack technique descriptions.
（3）知识图谱（Knowledge Graph）
知识图谱是一种以“实体—关系—实体（三元组）”形式组织和存储知识的图结构数据库。
A knowledge graph is a graph-structured database that organizes and stores knowledge in the form of "entity–relationship–entity" (triples).
（4）风险推送（Risk Notification）
风险推送是指根据系统中软件组件与漏洞信息的匹配结果，自动向用户发送相关漏洞风险和预警信息的过程。
Risk notification refers to the process of automatically sending relevant vulnerability risk and alert information to users based on the results of matching software components within the system against vulnerability data.
三、知识补充（Supplementary Knowledge）
CTI知识图谱（Cyber Threat Intelligence Knowledge Graph）是以网络威胁情报为核心，通过整合漏洞、软件、补丁、攻击技术、恶意软件和攻击组织等实体及其关联关系构建的知识网络，其目的是实现威胁信息融合、漏洞关联分析、攻击路径推理和风险智能预警。
The Cyber Threat Intelligence (CTI) Knowledge Graph is a knowledge network centered on cyber threat intelligence, constructed by integrating entities—such as vulnerabilities, software, patches, attack techniques, malware, and threat actors—and their interrelationships. Its purpose is to enable the fusion of threat information, vulnerability correlation analysis, attack path inference, and intelligent risk early warning.
今天的分享就到这里了，
如果您对文章有独特的想法，
欢迎给我们留言，
让我们相约明天。
祝您今天过得开心快乐！
That's all for today's sharing.
If you have a unique idea about the article,
please leave us a message,
and let us meet tomorrow.
I wish you a nice day!
翻译：Google翻译
参考资料：ChatGPT
参考文献：王丽敏, 吴敬征, 武延军, 等. 开源软件供应链漏洞威胁智能感知[J].软件学报, 2025, 36(2): 511-536. DOI:10.13328/j.cnki.jos.007163.
本文由LearningYard学苑整理发出，如有侵权请在后台留言！
文案|yy
排版|yy
审核|chen
