Code Signature Generation for Modified Software Component Detection

Solution Overview

Problem

Current methods for detecting third-party software components within a software codebase are inadequate, as they fail to address modifications, require significant processing power, and are inaccurate when headers are missing or file names and locations are changed, leading to difficulties in identifying software components.

Innovation Solution

A system and method that generates a code signature for source files by identifying programming language-specific keywords and control characters, replacing them with compact byte representations, and hashing the encoded sequence to produce a unique signature for identifying third-party software components, regardless of modifications such as variable or function name changes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional content matching analysis is used to identify third-party software, then the method can detect unmodified software files, but it fails to accurately identify modified software components where headers are missing or file names are changed

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to handle modified code

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent extracts only the essential structural elements (keywords and control characters) from the source code, removing non-essential elements like variable names, function names, and comments. This extracted structural signature enables identification of modified code while maintaining accuracy, as the core structural pattern remains unchanged even when specific identifiers are modified.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent transforms the code representation by changing parameters: replacing variable names with placeholders, removing comments, and normalizing whitespace. This parameter transformation creates a standardized structural signature that is invariant to common code modifications, enabling accurate detection of third-party software regardless of name changes or minor modifications.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If comprehensive code analysis is performed to accurately identify software components, then detection precision improves, but processing time and computational resources increase significantly

Engineering Contradiction:

Improveidentification accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts only the essential structural elements (keywords and control characters) from the source code, removing non-essential elements like variable names, function names, and comments. This extracted structural signature enables identification of modified code while maintaining accuracy, as the core structural pattern remains unchanged even when specific identifiers are modified.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the code analysis process into two phases: offline generation of structural signatures for known third-party software, and online matching of query code against these pre-generated signatures. This segmentation eliminates the need for comprehensive pairwise comparison during online operation, significantly reducing processing time while maintaining detection accuracy.

Inventive Principle:

Principle #1Segmentation

3Use of energy by moving object

If manual tracking of software components is performed, then resource consumption is low, but the method is insufficient for determining the location of software components in large codebases

Engineering Contradiction:

Improvecomputational resource consumptionVSAvoidcomponent location determination capability

Core Design Contradiction:

Use of energy by moving objectVSProductivity

Solution Approach 1:

The patent implements automated detection that performs itself without human intervention. The system automatically generates structural signatures, compares code against a database of third-party software signatures, and identifies matches. This self-service automation enables comprehensive codebase scanning that would be impractical manually, while keeping computational resources manageable through efficient signature-based matching.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent extracts only the essential structural elements (keywords and control characters) from the source code, removing non-essential elements like variable names, function names, and comments. This extracted structural signature enables identification of modified code while maintaining accuracy, as the core structural pattern remains unchanged even when specific identifiers are modified.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentEP3347814B1Identifying software components in a software codebase

Publication Date: 2024.08.28 BLACK DUCK SOFTWARE INC

Figure 1
Figure 2
Figure 3

AI summary

Systems, methods, and computer program embodiments are disclosed for detecting software components in a software codebase. In an embodiment, a source file containing source code may be received, and a code signature may be generated for the source file based on a determined structure of the source code. The generated code signature may then be compared to signatures stored in a reference database to identify matching software files. In an embodiment, the reference database may store a plurality of code signatures corresponding to software files. A list of the identified software files may be created and presented to a user.