Traversing software components and dependencies for vulnerability analysis
Systems, devices, computer-implemented methods, and/or computer program products that facilitate software vulnerability analysis using relationship data extracted from disparate package-related sources. In one example, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise a knowledge induction component and a vulnerability component. The knowledge induction component can populate a package ontology for a range of packages with relationship data extracted from a plurality of disparate package-related sources. The vulnerability component can identify an implicit vulnerability impacting the range of packages using the package ontology and a vulnerability record regarding an explicit vulnerability for a package within the range of packages.
1. A system, comprising:
a processor that executes the following computer-executable components stored in memory:
a knowledge induction component that populates a package ontology for a range of packages with relationship data extracted from a plurality of disparate package-related sources; and
a vulnerability component that identifies an implicit vulnerability impacting the range of packages using the package ontology and a vulnerability record regarding an explicit vulnerability for a package within the range of packages, wherein the knowledge induction component populates the package ontology with the relationship data by concatenating continuous sequences of noun phrases and identified basic entities within sentences of vulnerability descriptive data to build candidate N-gram entities.
2. The system of claim 1 , wherein the plurality of disparate package-related data sources comprises unstructured data.
3. The system of claim 1 , wherein the plurality of disparate package-related sources includes package documentation data, vulnerability descriptive data, code repository data, or a combination thereof.
4. The system of claim 1 , wherein the knowledge induction component populates the package ontology with the relationship data by evaluating vulnerability descriptive data to identify sentences that reference terms indicative of vulnerabilities.
5. The system of claim 1 , wherein the knowledge induction component populates the package ontology with the relationship data by evaluating sentences of vulnerability descriptive data to identify basic entities, and wherein the sentences of vulnerability descriptive data comprise terms indicative of vulnerabilities.
6. The system of claim 1 , and wherein the sentences of vulnerability descriptive data comprise terms indicative of vulnerabilities.
7. The system of claim 1 , wherein the relationship data includes intra-package relationship data, inter-package relationship data, or a combination thereof.
8. The system of claim 1 , wherein the relationship data includes a first knowledge graph comprising intra-package relationship data and a second knowledge graph comprising inter-package relationship data.
9. The system of claim 8 , wherein the vulnerability component identifies the implicit vulnerability by traversing the first and second knowledge graphs to identify another package within the range of packages that is dependent on a component of the package that is affected by the explicit vulnerability.
10. The system of claim 1 , further comprising:
a bootstrap component that bootstraps the package ontology using data mined from a curated knowledge graph.
11. The system of claim 1 , further comprising:
a validation component that modifies the package ontology via a feedback mechanism.
12. A computer-implemented method, comprising:
populating, by a system operatively coupled to a processor, a package ontology for a range of packages with relationship data extracted from a plurality of disparate package-related sources; and
identifying, by the system, an implicit vulnerability impacting the range of packages using the package ontology and a vulnerability record regarding an explicit vulnerability for a package within the range of packages, wherein the system populates the package ontology with the relationship data by concatenating continuous sequences of noun phrases and identified basic entities within sentences of vulnerability descriptive data to build candidate N-gram entities.
13. The computer-implemented method of claim 12 , wherein the plurality of disparate package-related sources includes package documentation data, vulnerability descriptive data, code repository data, or a combination thereof.
14. The computer-implemented method of claim 12 , wherein the system populates the package ontology with the relationship data by evaluating sentences of vulnerability descriptive data to identify basic entities, and wherein the sentences of vulnerability descriptive data comprise terms indicative of vulnerabilities.
15. The computer-implemented method of claim 12 , wherein the sentences of vulnerability descriptive data comprise terms indicative of vulnerabilities.
16. The computer-implemented method of claim 12 , wherein the relationship data includes a first knowledge graph comprising intra-package relationship data and a second knowledge graph comprising inter-package relationship data.
17. The computer-implemented method of claim 16 , wherein the system identifies the implicit vulnerability by traversing the first and second knowledge graphs to identify another package within the range of packages that is dependent on a component of the package that is affected by the explicit vulnerability.
18. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
populate, by the processor, a package ontology for a range of packages with relationship data extracted from a plurality of disparate package-related sources; and
identify, by the processor, an implicit vulnerability impacting the range of packages using the package ontology and a vulnerability record regarding an explicit vulnerability for a package within the range of packages, wherein the processor populates the package ontology with the relationship data by concatenating continuous sequences of noun phrases and identified basic entities within sentences of vulnerability descriptive data to build candidate N-gram entities.
19. The computer program product of claim 18 , wherein the sentences of vulnerability descriptive data comprise terms indicative of vulnerabilities.
20. The computer program product of claim 18 , wherein the relationship data includes a first knowledge graph comprising intra-package relationship data and a second knowledge graph comprising inter-package relationship data, and wherein the processor identifies the implicit vulnerability by traversing the first and second knowledge graphs to identify another package within the range of packages that is dependent on a component of the package that is affected by the explicit vulnerability.