Research on Open-Source Component Homology Analysis Model Based on Graph Neural Network and Attention Mechanism

The widespread introduction of open-source components in the software supply chain has led to complex component dependency relationships and numerous security risks. This article proposes an open-source component homology analysis model based on a combination of graph neural networks and attention mechanisms. By transforming the homology analysis problem of components in the software supply chain into the homology analysis problem of component source code. The model first extracts the graph representation of the source code of the open source component, takes the code attribute graph covering more source code semantic and syntactic information as the graph structure feature, and then uses the graph neural network to aggregate the graph structure data of the code attribute graph to obtain the node-level embedding representation of the code attribute graph, and then aggregates the global information contained in each graph node by combining the attention mechanism to obtain the graph embedding representation of the code attribute graph. Finally, the similarity score obtained by graph similarity calculation is used to determine the homology relationship of open source components. Compared with the comparison model, this model has a better ability to analyze the homology of components, and realizes the governance of security risks of open source components from the source.