Binary Scan Engine Parallel Pattern Matching Software Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software due diligence systems face challenges in efficiently reviewing and ensuring compliance with open source licenses, intellectual property rights, and export regulations due to the complexity of managing large code bases, binary files, and the lack of effective mechanisms for tracking license compatibility and undocumented open source components.
Innovation Solution
A system and method that utilizes a binary scan engine, parallel pattern matching, a code provenance engine, and a workflow engine to automate the review of software components for compliance, including tracking licenses, identifying undocumented open source, and generating compliance reports, while integrating with build systems to ensure continuous review and validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sequential pattern matching is used to review software components, then false negatives are minimized, but productivity decreases substantially as the number of software components increases
Solution Approach 1:
The patent divides the compliance review task into multiple independent threads that can process different software components simultaneously. Each thread handles pattern matching for specific components, allowing parallel execution without compromising the thoroughness of individual reviews.
Solution Approach 2:
The patent transitions from sequential single-thread processing to multi-threaded parallel processing, adding a temporal dimension to the review process. This allows multiple components to be reviewed concurrently, significantly improving productivity while maintaining review quality through coordinated thread management.
2Reliability
If binary files are inspected for license compliance, then comprehensive coverage is achieved, but device complexity increases due to the difficulty of inspecting binaries compared to source code
Solution Approach 1:
The patent performs preliminary actions by extracting and analyzing metadata from binary files before full compliance review. This includes extracting package information, dependency graphs, and license declarations, which simplifies subsequent compliance checking while maintaining comprehensive coverage.
Solution Approach 2:
The patent introduces an intermediary layer that translates binary file analysis into compliance-checkable formats. This intermediary processing layer simplifies the complexity of direct binary inspection by converting binary data into structured representations that are easier to analyze for license compliance.
3Measurement precision
If comprehensive license tracking is implemented, then compliance accuracy is improved, but device complexity increases due to the need to manage hundreds of different licenses and their compatibility rules
Solution Approach 1:
The patent segments the license management system into modular components, with each thread handling specific license types or compatibility rules. This segmentation allows the system to manage hundreds of licenses through organized, manageable units rather than a monolithic complex system.
Solution Approach 2:
The patent creates a universal license management framework that can handle multiple license types and compatibility scenarios through a single integrated system. This universal approach reduces overall complexity by using general-purpose mechanisms that work across different license types rather than requiring separate specialized systems for each license type.
Data Source
AI summary
A system and method is provided for performing software due diligence review, which may include reviewing software for compliance and compatibility with software licenses, export regulations, or other compliance issues. In one implementation, the system may include a binary scan engine configured to analyze binary objects and extract dependency information identifying source code that may be associated with the binary objects. Upon identifying relevant source code, the system may use parallel pattern matching techniques to identify certain keywords in the source code and/or to match the keywords to text patterns that contain excerpts of language relevant to software due diligence. The system may then check for permissions and obligations associated with any matching relevant language to draw inferences regarding potential compliance problems.