Code Sensor Platform for AI BOM and Vulnerability Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for managing and documenting AI libraries, models, and datasets in software development are manual, prone to errors, time-consuming, and lack the capability to assess risks and vulnerabilities effectively.
Innovation Solution
A multi-faceted Code Sensor system comprising a Detect AI module, a Deep Scan module, and a Vulnerability Scan module, which identifies AI components, generates an AI Bill-of-Materials (BOM), and assesses risks and vulnerabilities by cross-referencing with Open-Source Resources and a Threat Intelligence Database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual methods are used to identify and catalog AI components, then the process is simple to implement, but it is time-consuming and error-prone
Solution Approach 1:
The patent replaces manual mechanical analysis with automated computational analysis using Abstract Syntax Tree (AST) generation and Large Language Models. The system automatically parses code repositories, generates AST representations, and uses AI models to identify AI components, eliminating manual effort while maintaining accuracy.
Solution Approach 2:
The patent introduces an intermediary AST generation step that transforms code into a structured intermediate representation. This AST serves as a mediator between the raw code and the final AI component identification, enabling systematic and automated analysis without manual intervention.
2Measurement precision
If existing automated solutions are used to detect dependencies, then the identification speed improves, but they lack the capability to determine context of use in AI projects
Solution Approach 1:
The patent replaces traditional dependency detection mechanisms with Large Language Model-based analysis. The LLM processes the AST representation and contextual information to accurately identify AI components and their usage contexts, achieving higher precision than conventional automated tools.
Solution Approach 2:
The patent adds a new dimension of analysis by generating and analyzing AST representations of code. This transforms the problem from simple string-matching dependency detection to structured syntactic analysis, enabling accurate identification of AI component usage contexts.
3Loss of information
If comprehensive AI component cataloging is performed, then the understanding of AI usage improves, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary AST generation and code parsing before the actual AI component identification. By pre-processing the code into structured representations and identifying potential AI-related patterns early, the system reduces the time required for comprehensive analysis while maintaining documentation completeness.
Solution Approach 2:
The patent uses LLMs to perform selective deep analysis only on portions of code that are likely to contain AI components, rather than analyzing every line uniformly. This targeted approach maintains comprehensive documentation of AI usage while reducing overall analysis time through intelligent sampling and prioritization.
Data Source
AI summary
A code sensor system is provided, configured for execution by one or more processors, for cataloging and analyzing code repositories containing Artificial Intelligence (“AI”) and associating risks and vulnerabilities to the code repositories, the system comprising: a Detect AI module configured to identify code repositories that may contain AI; a Deep Scan module configured to generate an AI Bill-of-Materials (“BOM”) from the code repositories, the AI BOM including a plurality of categories including technologies, models and datasets; a Vulnerability Scan module configured to generate an interactive assessment of the risks and vulnerabilities associated with the AI BOM by cross-referencing content of the AI BOM with Open-Source Resources and a Threat Intelligence Database; a Code Sensor Platform configured to control the operation of the Detect AI module, the Deep Scan module and the Vulnerability Scan module; and a User Interface configured to display the risks and vulnerabilities to a user.