A Vulnerability Analysis Method for Open-Source Components Based on Relational Subgraph Fusion

Abstract

The open-source component-based development model has been widely adopted in software engineering. However, the complex correlations between open-source component dependency chains and vulnerabilities are difficult to effectively characterize, making it challenging to accurately identify vulnerabilities and quantify their impact scope. To address these issues, this paper proposes an open-source component vulnerability analysis method based on relational subgraph fusion. First, by parsing open-source component dependency configuration files, a knowledge graph containing components, versions, vulnerabilities, and their relationships is constructed, unifying the modeling of component dependencies and vulnerability information. Second, relational subgraphs centered on open-source components and vulnerabilities are constructed by relationship type. Graph Attention Networks (GAT) and multi-head attention mechanisms are employed to extract embedded representations of different subgraphs, and attention-weighted fusion achieves deep integration of multi-centered subgraph features, effectively distinguishing the heterogeneous impacts of different relationship types on central nodes. Finally, similarity matching is used to identify candidate triplets, and meta-path evaluation is combined to compute the scope of vulnerabilities' impact on open-source components. Experimental results demonstrate that the proposed method can effectively achieve comprehensive analysis of open-source components and vulnerabilities in the software supply chain.