| 引用本文： |
-
陈彦如,李秋香,赵凯,杜彦辉.开源组件漏洞风险评估技术研究综述[J].信息安全学报,已采用 [点击复制]
- chenyanru,liqiuxiang,zhaokai,duyanhui.A Survey on Vulnerability Risk Assessment Techniques for Open-Source Components[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 随着现代软件系统对开源组件的依赖不断加深，开源组件引入的漏洞已成为软件供应链安全风险的重要来源。如何准确识别组件及其漏洞，并科学评估真实风险，是当前网络空间安全治理中的关键问题。现有研究在组件识别与漏洞风险评估方面提出了多种技术方法，但多数工作仍聚焦于单一技术环节，缺乏对漏洞评估结果与系统实际风险之间关联机制的系统性分析。针对上述问题，本文从风险决策视角出发，提炼了语义等价与语法表征不一致、静态评分与动态运行环境不匹配、局部检测结果与全局决策需求不一致三个关键问题，构建了“组件识别与依赖解析—漏洞可达性与成立性分析—上下文融合与风险量化”的分层分析模型。在漏洞识别方面，系统梳理了基于源码/清单的SCA、面向二进制制品的SCA以及静态与动态可达性分析技术，揭示了不同技术在语义表达能力、覆盖范围与分析精度之间的内在关系。在风险评估方面，本文系统分析了以CVSS为代表的传统评分体系的演进路径与局限性，重点讨论了融合资产价值、运行环境与威胁情报的上下文感知评估模型，揭示了漏洞风险评估从静态技术评分向情境化风险量化的演进趋势。最后，归纳了现有方法在技术实现、数据生态及组织治理方面的主要挑战，并提出了可信性评估、多源情境融合、知识图谱推理及DevSecOps集成等未来研究方向。本研究旨在为构建兼具精度、可解释性及工程可实施性的下一代开源组件漏洞管理体系提供理论参考。 |
| 关键词: 软件供应链安全 开源组件 漏洞识别 风险评估 上下文感知 |
| DOI： |
| 投稿时间：2026-02-08修订日期：2026-06-17 |
| 基金项目: |
|
| A Survey on Vulnerability Risk Assessment Techniques for Open-Source Components |
|
chenyanru1, liqiuxiang2, zhaokai3, duyanhui1
|
| (1.People’s Public Security University of China;2.Tsinghua University;3.Zhengzhou Police University) |
| Abstract: |
| As modern software systems increasingly rely on open-source components, vulnerabilities introduced by third-party components have become a significant source of software supply chain security risks. Accurately identifying components and their associated vulnerabilities, and assessing their actual risk, has become a critical challenge in cybersecurity governance.Existing research has proposed various technical methods for component identification and vulnerability assessment. However, most efforts remain focused on isolated technical aspects, lacking a systematic analysis of the linkage mechanism between vulnerability assessment results and the actual risk to systems. To address this gap, this paper adopts a risk-informed decision-making perspective to construct a unified analytical framework that spans the entire process of open-source component vulnerability identification, risk assessment, and security decision support.This paper distills three core challenges in open-source component vulnerability assessment—the inconsistency between semantic equivalence and syntactic representation, the mismatch between static scoring and dynamic runtime environments, and the gap between local detection results and global decision-making requirements—and constructs a three-layer analytical model comprising "component identification and dependency resolution, vulnerability reachability and exploitability analysis, and contextual fusion and risk quantification." In the identification phase, we systematically review source/build-file-based SCA, binary-based SCA, and static and dynamic reachability analysis, highlighting the trade-offs among semantic precision, coverage, and analytical accuracy. For risk assessment, we analyze the evolution and limitations of traditional scoring systems represented by CVSS, and focus on context-aware models that integrate asset value, operating environment, and threat intelligence, illustrating the shift from static technical scoring to situational risk-driven decision making. Finally, we summarize the major challenges in technology implementation, data ecosystem, and organizational governance, and discuss future research directions including trustworthy evaluation, multi-source context integration, knowledge-graph-based reasoning, and DevSecOps integration. This study aims to provide a theoretical reference for building next-generation open-source component vulnerability management systems that balance precision, interpretability, and engineering feasibility. |
| Key words: Software supply chain security Open-source components Vulnerability identification Risk assessment Context-aware analysis |
