Build SBOM Generation for Large Distributed Software Builds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software bill of materials (SBOM) systems are not effectively configured to trigger threat mitigation and are plagued by variability in design and application, leading to inaccurate risk assessments and unnecessary remedial actions, especially in large distributed builds.
Innovation Solution
The system generates a build SBOM for large programming builds by identifying and omitting declarations for files or dependencies not utilized by the build, while adding new declarations for code segments not properly attributed in chunk SBOMs, and uses configuration restriction records to assess and resolve threat events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional SBOMs include all files from all underlying program chunks, then the SBOM is comprehensive in identifying potential files, but it becomes overinclusive and identifies many files not actually utilized by the build, leading to false vulnerability assessments
Solution Approach 1:
The patent segments the monolithic SBOM generation process into analyzing individual program chunks and their utilization status. By dividing the build into discrete chunks and evaluating each chunk's actual usage, the system identifies which files are genuinely needed versus those that are merely present but unused, thereby reducing false positives in vulnerability assessments
Solution Approach 2:
The patent extracts and removes declarations for files that are not actually utilized by the build from the SBOM. By comparing the declared files against actual build utilization, the system extracts only the necessary files into the final SBOM, eliminating overinclusive declarations that would trigger unnecessary remedial actions
2Loss of time
If SBOMs are created during development cycle prior to compilation, then they can be generated early, but they cannot verify whether declared components actually exist or are utilized in the final program
Solution Approach 1:
The patent performs preliminary SBOM generation during the development cycle based on available information, but then applies a verification step after compilation to validate which declared components actually exist and are utilized. This two-stage approach allows early SBOM creation while maintaining accuracy through subsequent verification
Solution Approach 2:
The patent implements a feedback mechanism where the actual build output is analyzed to verify whether declared components exist and are utilized. This feedback from the compiled program informs the refinement of the SBOM, ensuring that only actually present and used components are accurately declared
3Reliability
If conventional systems perform remedial actions on all programs with vulnerable files identified in SBOMs, then security threats are addressed, but resources are wasted on unaffected programs that do not contain the vulnerable files
Solution Approach 1:
The patent extracts and identifies the specific subset of files that are actually utilized by the build from the complete set of declared files. By comparing vulnerable files against this extracted subset of actually-used files, the system determines whether remedial actions are truly necessary, preventing waste of computational resources on programs that don't actually contain the vulnerable files
Data Source
AI summary
Systems are provided for generating, modifying and using SBOMs for facilitating risk assessment and threat mitigation for corresponding programs, and particularly for large programming builds. The creation and modification of the SBOMs includes processes for omitting declarations referenced in chunk SBOMs of program chunks incorporated into a final programming build associated with a build SBOM, but which are not actually utilized by the final programming build, as well as processes for adding new declarations for code segments that are not declared in the related chunk SBOMs, even though the code segments are utilized by the final programming build. Systems are also configured to use SBOMs in combination with configuration restriction records to assess and resolve threat events in a manner that can prevent unnecessary remedial actions for threat events that appear to be relevant to one or more files or dependencies incorporated into a program.