Software Build Traffic Monitoring for Accurate sBOM Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software developers face challenges in generating complete and accurate software bill of materials (sBOMs) due to the complexity of software build processes, which conventional methods like Software Component Analysis (SCA) tools are prone to false positives and negatives, and manual correction is costly and inefficient.
Innovation Solution
A system that monitors network traffic during software builds using a Man-in-the-Middle proxy server to log software artifact downloads, retrieves metadata, and generates a complete sBOM by inspecting network traffic, ensuring accuracy and automation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If Software Component Analysis (SCA) tools are used to generate sBOMs, then automation is achieved, but accuracy deteriorates due to false positives and negatives
Solution Approach 1:
The patent introduces a Man-in-the-Middle (MITM) proxy server as an intermediary component between the build system and external repositories. This proxy intercepts and monitors all network traffic during the software build process, capturing download requests and responses. By positioning this intermediary observer in the network flow, the system automatically extracts accurate information about software artifacts used in the build without interfering with the build process itself, thereby resolving the contradiction between automation and accuracy
Solution Approach 2:
The patent replaces the mechanical analysis approach of SCA tools (which statically analyze software components) with a network traffic monitoring approach. Instead of attempting to parse and analyze software artifacts to identify dependencies, the system directly observes the network downloads that occur during the build process. This substitution of the detection mechanism eliminates the false positives and negatives inherent in static analysis while maintaining full automation
2Measurement precision
If manual correction of sBOMs is performed, then accuracy is improved, but productivity deteriorates due to costly and inefficient manual effort
Solution Approach 1:
The system implements self-service by automatically generating accurate sBOMs through network traffic monitoring without requiring manual intervention. The MITM proxy captures all download information during the build process, and the system automatically processes this data to create the software bill of materials. This eliminates the need for manual correction while maintaining both accuracy and high productivity, as the entire process is automated and occurs in real-time during the build
3Quantity of substance
If network traffic monitoring is implemented, then completeness of sBOM is improved, but device complexity increases due to additional infrastructure requirements
Solution Approach 1:
The MITM proxy server performs multiple functions: it monitors network traffic for sBOM generation, enforces security policies, and can intercept unauthorized downloads. By making this single component multi-functional, the patent reduces overall system complexity despite the added infrastructure, as one universal component replaces what would otherwise require multiple specialized systems
Data Source
AI summary
An apparatus comprises a processing device configured to monitor network traffic of a software build process for a given piece of software, and to identify, utilizing the monitored network traffic, software artifacts downloaded for generating a software image for the given piece of software. The processing device is also configured to determine, for each of the identified software artifacts, software artifact metadata comprising software component configurations for that software artifact. The processing device is further configured to generate a software component data structure for the given piece of software comprising information characterizing the software component configurations for each of the identified software artifacts. The processing device is further configured to store the generated software component data structure for the given piece of software in association with the generated software image for the given piece of software.