Technology for assessing the impact of security vulnerabilities in the software supply chain

This paper has explored the technology for assessing the impact of security vulnerabilities within the software supply chain, covering issues such as library migration in the Java ecosystem, the use and updating of third-party libraries, and the cleaning up of bloated dependencies. We have introduced formalised metrics for the software supply chain and proposed a multi-core parallel dependency resolution method to enhance the accuracy and efficiency of vulnerability detection. Furthermore, the paper has presented formalised definitions of indicators for the software supply chain and provided solutions to address the issues of accuracy and efficiency in dependency resolution. Lastly, the paper has identified deficiencies in current research, such as data timeliness and detection efficiency, and outlined directions for future research.