System Security Assessment Method Integrating Risk Relationships of Open Source Software

In response to the deficiency in existing system security assessment methods that often lack research on the propagation risks caused by the open source software supply chain (OSSSC). This paper proposes a system security assessment method that integrates the risk relationships of open source software (OSS). Firstly, an OSS risk propagation relationship graph is constructed, and the Fuzzy Analytic Hierarchy Process (FAHP)-entropy weight method is adopted to allocate weights to the weakness assessment indicators of OSS, thereby improving the accuracy of quantifying OSS propagation risks. Then, on the attack graph, the analysis of threat values to host nodes and the probability of successful attack paths are optimized from three perspectives: vulnerabilities, OSSSC, and hosts. Experimental results demonstrate that this method, by combining open source risk factors and conducting multi-dimensional analysis, can more effectively assess the security threats faced by systems, providing a more accurate basis for security defense.