夜雨聆风
分享兴趣，传播快乐，
增长见闻，留下美好！
亲爱的您，这里是LearningYard学苑。
今天小编为大家带来
“颜读（154）：精读期刊论文《开源软件供应链漏洞威胁智能感知》第一章背景”
欢迎您的访问！
Share interest, spread happiness,
increase knowledge, and leave beautiful.
Dear, this is the LearningYard Academy!
Today, the editor brings the
“Yan Du (154): In-depth reading of the journal paper ‘Intelligent Perception of Vulnerability Threats in the Open Source Software Supply Chain’—Chapter 1: Background”
Welcome to visit!
今天小编将从思维导图、精读内容、知识补充三个板块为大家带来《开源软件供应链漏洞威胁智能感知》第一章背景的介绍。
Today, the editor will introduce thechapter 1background of "Intelligent Perception of Open Source Software Supply Chain Vulnerabilities and Threats" from three sections: mind mapping, intensive reading content, and knowledge supplement.
一、思维导图（Mind Mapping）
二、精读内容（Conduct in-depth reading of the material）
1.开源软件供应链风险分析技术（Risk Analysis Technology for Open Source Software Supply Chains）
从开源软件供应链的不同环节出发,将其威胁模型分为3个类别,即组件和应用软件开发环节、应用软件分发环节、应用软件使用环节。组件和应用软件开发环节涉及开发环境构建与开发依赖的选择,这些过程都可能受到攻击者的威胁。应用软件分发环节是软件开发完成后向用户提供服务的一个重要的环节，有不少攻击者能够绕过分发平台的检测流程,将携带威胁的软件分发到平台上。应用软件使用环节主要涉及用户对软件的下载和运行环境的配置,这些环节也存在着安全风险.攻击者可能在下载过程中利用中间人攻击等技术,诱导用户连接到恶意站点,或者篡改软件的内容。
Based on the various stages of the open-source software supply chain, threat models can be categorized into three types: component and application software development, application software distribution, and application software usage. The development stage involves setting up development environments and selecting dependencies, processes that are vulnerable to attacks. The distribution stage—where software is provided to users after development—is a critical link; attackers often manage to bypass the detection mechanisms of distribution platforms to disseminate malicious software. The usage stage primarily concerns software downloading and the configuration of runtime environments, both of which entail security risks. During the download process, attackers may employ techniques such as man-in-the-middle attacks to lure users to malicious sites or tamper with the software's content.
2.知识图谱与漏洞感知技术（Knowledge Graphs and Vulnerability Awareness Technology）
态势感知是一种能够基于多种环境因素动态洞察风险的能力,它从多特征的角度来发现、识别和处理威胁。知识图谱是一种用于表示和存储知识的结构化数据模型,它最早由谷歌提出,用于增强其搜索引擎功能。知识图谱技术也大量应用于安全领域中。
Situational awareness is the capability to gain dynamic insight into risks based on various environmental factors; it detects, identifies, and addresses threats by analyzing multiple characteristics. A knowledge graph is a structured data model used to represent and store knowledge; originally introduced by Google to enhance its search engine capabilities, knowledge graph technology is now also widely applied in the field of security.
3.文本表示模型（Textrepresentationmodels）
（1）统计语言表示模型（Statisticallanguagerepresentationmodels）
语言表示模型最初是为了计算句子合理性概率而发展起来的。基于统计学的语言表示模型不需要通过人工指定维度和训练语义向量,只需要通过语料信息构建自然语言的数学模型。
Language representation models were originally developed to calculate the probability of sentence plausibility. Statistical language representation models do not require the manual specification of dimensions or the training of semantic vectors; instead, they construct mathematical models of natural language based solely on corpus information.
（2）神经语言表示模型（Neural language representation models）
语言表示模型是为了计算句子合理性概率而发展起来的,它可以用于自然语言处理的各种任务中。
Language representation models were developed to calculate the probability of sentence plausibility and can be used in various natural language processing tasks.
4.关联关系挖掘技术（Association relationship mining technology）
（1）基于规则的关联关系挖掘技术（Rule-based association mining technology）
基于规则的关联关系挖掘技术也叫基于模板的关联关系挖掘技术,它需要先定义好关系类别模板,然后用模板匹配文本,得到文本中的关系类别。
Rule-based association mining—also known as template-based association mining—requires the prior definition of relationship category templates; these templates are then used to match against the text to identify the relationship categories present within it.
（2）基于学习的关联关系挖掘技术（Learning-based association mining techniques）
基于学习的关联关系挖掘技术通过大规模语料库训练关系抽取模型，将关联关系挖掘问题转化为分类或聚类的问题。
Learning-based association mining techniques train relation extraction models using large-scale corpora, thereby transforming the problem of association mining into a classification or clustering task.
三、知识补充（SupplementaryKnowledge）
COALS模型是一种基于语料库的分布式语义模型，通过统计词汇在局部上下文中的共现关系，并利用相关性分析构建词语的高维语义向量，以表征词汇之间的语义相似性。相较于直接采用共现频数的传统模型，COALS采用相关系数对共现矩阵进行转换，从而降低高频词带来的影响，提高语义表示的准确性。
COALS is a corpus-based distributed semantic model that represents semantic similarity between words by statistically analyzing their co-occurrence within local contexts and using correlation analysis to construct high-dimensional semantic vectors. Unlike traditional models that rely directly on raw co-occurrence frequencies, COALS transforms the co-occurrence matrix using correlation coefficients; this approach mitigates the influence of high-frequency words and enhances the accuracy of semantic representations.
今天的分享就到这里了，
如果您对文章有独特的想法，
欢迎给我们留言，
让我们相约明天。
祝您今天过得开心快乐！
That's all for today's sharing.
If you have a unique idea about the article,
please leave us a message,
and let us meet tomorrow.
I wish you a nice day!
翻译：Google翻译
参考资料：ChatGPT
参考文献：王丽敏, 吴敬征, 武延军, 等. 开源软件供应链漏洞威胁智能感知 [J].软件学报, 2025, 36(2): 511-536. DOI:10.13328/j.cnki.jos.007163.
本文由LearningYard学苑整理发出，如有侵权请在后台留言！
