夜雨聆风
分享兴趣，传播快乐，
增长见闻，留下美好！
亲爱的您，这里是LearningYard学苑。
今天小编为大家带来
“颜读（163）：精读期刊论文《开源软件供应链漏洞威胁智能感知》第三章实验分析（2）”
欢迎您的访问！
Share interest, spread happiness,
increase knowledge, and leave beautiful.
Dear, this is the LearningYard Academy!
Today, the editor brings the
“Yan Du (163): In-depth reading of the journal paper ‘Intelligent Perception of Vulnerability Threats in the Open Source Software Supply Chain’—Chapter 3: Experimental Analysis (2).”
Welcome to visit!
今天小编将从思维导图、精读内容、知识补充三个板块为大家带来《开源软件供应链漏洞威胁智能感知》第三章实验分析（2）的介绍。
Today, we present an introduction to the experimental analysis (Part 2) of Chapter 3 of Intelligent Perception of Vulnerability Threats in the Open Source Software Supply Chain, covering three sections: a mind map, an in-depth analysis of the content, and supplementary knowledge.
一、思维导图（Mind Mapping）
二、精读内容（Conduct in-depth reading of the material）
1.实验方法与结果分析（Experimental Methods and Analysis of Results）
（1）CTI知识图谱构建模块效果评估（Performance Evaluation of CTI Knowledge Graph Construction Modules）
1）CTI知识图谱数据及时效性评估（CTI Knowledge Graph Data and Timeliness Assessment）
本文通过自顶向下的方式构建知识图谱,通过参考STIX2.1、ATT&CK等多种数据标准及数据结构,设计并实现本体架构,其中包含26类实体及41类实体之间的关系。通过部署爬虫系统,实时获取并分析相关数据源,根据本体结构进行数据融合,实现CTI知识图谱的构建。最后将涉及Linux操作系统的51590个安全漏洞进行测试。
This paper constructs a knowledge graph using a top-down approach. By referencing various data standards and structures—such as STIX 2.1 and ATT&CK—an ontology architecture was designed and implemented, comprising 26 entity types and 41 types of relationships between them. A web crawling system was deployed to acquire and analyze relevant data sources in real time, and data fusion was performed based on the ontology structure to build the CTI knowledge graph. Finally, the system was tested using 51,590 security vulnerabilities associated with the Linux operating system.
2）信息抽取模型效果评估（Performance Evaluation of Information Extraction Models）
本文方法针对信息缺失问题,采用BERT+LSTM+CRF模型作为文本抽取模型,为了验证该模型效果,本文选取CVErizer与NER-ES作为实体、关系抽取任务的基线进行对比实验。
To address the issue of missing information, this paper employs a BERT-LSTM-CRF model for text extraction. To evaluate the model's performance, comparative experiments were conducted using CVErizer and NER-ES as baselines for the entity and relation extraction tasks.
3）实体间映射关系挖掘效果评估（Evaluation of the Effectiveness of Mapping Relationship Mining Between Entities）
为了验证SecERNIE模型在安全领域方面的语义提升效果,本文通过构建安全领域完型填空测试,将威胁情报、漏洞描述、攻击描述等文本,共构建测试样本277条。针对知识图谱中安全漏洞与攻击技术之间的映射关系挖掘任务,本文选取BERT和ERNIE作为语言表示模型基线,与SecERNIE模型进行对比实验。
To evaluate the semantic enhancement capabilities of the SecERNIE model in the security domain, this paper constructs a security-focused cloze test comprising 277 samples derived from texts such as threat intelligence, vulnerability descriptions, and attack descriptions. For the task of mining mappings between security vulnerabilities and attack techniques within a knowledge graph, BERT and ERNIE are selected as baseline language representation models for comparative experiments against SecERNIE.
（2）漏洞风险信息推送模块效果评估（Effectiveness Evaluation of the Vulnerability Risk Information Notification Module）
针对开源软件生态中操作系统子领域软件包别名问题,本文将NVD中所有安全漏洞涉及的753809个软件作为软件匹配基础数据集,并将CTI知识图谱中包含的103982个Linux系统软件使用软件名称及版本在基础数据集中查询,严格匹配到的系统软件数量为12478个,占比全部系统软件的12%。
Addressing the issue of software package aliases within the operating system sub-domain of the open-source software ecosystem, this paper utilizes the 753,809 software items associated with security vulnerabilities in the NVD as the baseline dataset for software matching. It then queries this baseline dataset—using software names and versions—for the 103,982 Linux system software items contained in the CTI knowledge graph; the number of system software items that yielded an exact match is 12,478, representing 12% of the total system software.
（3）实验方法可用性评估（Usability Evaluation of Experimental Methods）
为了评估本方法在开源软件供应链的实际运用效果(可用性),本文自2022年1月开始,将本方法应用于openEuler系统的Gitee官方开源托管平台,对其系统发行版包含的6726个开源软件进行漏洞威胁感知,并将感知结果以ISSUE的形式推送给系统官方,最后通过分析系统官方对ISSUE的处理情况来进行可用性评估。
To evaluate the practical effectiveness (usability) of this method within the open-source software supply chain, we applied it starting in January 2022 to the official openEuler project hosted on Gitee. We conducted vulnerability threat detection on the 6,726 open-source software packages included in the system's distribution, submitted the findings to the project maintainers as issues, and ultimately assessed the method's usability by analyzing how the maintainers handled these issues.
2.实例分析（Case Study Analysis）
通过对openEuler操作系统中包含的软件进行实验,在其包含的安全漏洞中挖掘出891个安全漏洞与攻击技术的关联关系,进而获取安全漏洞与缓解措施的间接关联.为验证其推理得到的漏洞威胁及缓解方法的有效性,本节从上述漏洞中随机选取两个安全漏洞进行防御前后的可达性实验。
By conducting experiments on the software included in the openEuler operating system, we identified 891 associations between security vulnerabilities and attack techniques, thereby uncovering indirect links between vulnerabilities and mitigation measures. To validate the effectiveness of the inferred vulnerability threats and mitigation methods, this section randomly selects two of the identified vulnerabilities and performs reachability experiments to compare the system state before and after the application of defenses.
三、知识补充（SupplementaryKnowledge）
网络嗅探是“监听并捕获网络数据包，再通过分析这些数据包来了解网络通信情况”的技术；在网络安全中，它既是网络诊断和安全监测的重要工具，也可能被攻击者用于信息窃取。
Network sniffing is a technique that involves monitoring and capturing network packets and then analyzing them to understand network traffic; in the context of cybersecurity, it serves as a vital tool for network diagnostics and security monitoring, yet it can also be exploited by attackers to steal information.
今天的分享就到这里了，
如果您对文章有独特的想法，
欢迎给我们留言，
让我们相约明天。
祝您今天过得开心快乐！
That's all for today's sharing.
If you have a unique idea about the article,
please leave us a message,
and let us meet tomorrow.
I wish you a nice day!
翻译：Google翻译
参考资料：ChatGPT
参考文献：王丽敏, 吴敬征, 武延军, 等. 开源软件供应链漏洞威胁智能感知 [J].软件学报, 2025, 36(2): 511-536. DOI:10.13328/j.cnki.jos.007163.
本文由LearningYard学苑整理发出，如有侵权请在后台留言！
文案|yy
排版|yy
审核|chen