Apparatus for quantifying security of open-source software package, and apparatus and method for optimizing open-source software package

An apparatus for optimizing an open-source software package, comprising:

• a server comprising a memory and a processor and at least one or more units being configured and executed by the processor using algorithm associated with least one non-transitory storage device, the units comprising,
• a deletion target selection unit for creating a deletion target package list, which is a list of packages to be deleted from a total list of packages installed in a client, based on a security score corresponding to an open-source software package;
• a package test unit for controlling states of one or more virtual machines included in the client and receiving a result of performing a test case to which the deletion target package list is applied from the client;
• a package optimization unit for creating an optimized package list based on the result of performing the test case;
• and
• a security information reception unit for receiving a security score for at least two of a Common Vulnerabilities and Exposures (CVE) record, a package binary file, a source file, and a package development project, which correspond to the open-source software package, from an apparatus for quantifying security of an open-source software package, which calculates the security score,
• wherein the package test unit receives the result of performing the test case for a list of packages remaining after packages in the deletion target package list are deleted from the total list of packages from the client,
• wherein the package test unit stores an initial state of the virtual machine, controls the virtual machine so as to perform the test case for a list of packages remaining after deleting a first deletion target package, restores the virtual machine to the initial state after the test case is performed, and controls the virtual machine so as to perform the test case for a list of packages remaining after deleting a second deletion target package.