Dependency CPE Scoring for Precise Software Vulnerability Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for detecting vulnerabilities in software projects using Structured Query Language (SQL) queries require significant manual effort and are prone to missing vulnerabilities, leading to potential security risks due to high false-positive rates and the need for substantial manual intervention.

Innovation Solution

A method involving a dependency file parser to generate a dependency common platform enumeration (CPE) and utilize a vulnerability database to create a condensed dataset of vulnerability CPEs, with a confidence score evaluation and machine learning model to filter results, reducing manual effort and improving accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SQL queries are used for Software Composition_analysis to map vulnerabilities to software components, then vulnerability detection can be performed, but the process requires significant manual work and is time-consuming

Engineering Contradiction:
Improvevulnerability detection accuracyVSAvoidtime required for vulnerability monitoring
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system automatically generates and executes SQL queries based on dependency information from package.json files, eliminating the need for manual query creation. The vulnerability matching process is fully automated, comparing dependency attributes with vulnerability database entries without human intervention, thus reducing both time consumption and manual effort while maintaining detection accuracy.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system pre-processes dependency information by extracting and structuring data from package.json files before vulnerability matching occurs. Dependency attributes are organized and stored in a standardized format in advance, enabling rapid automated querying and comparison with vulnerability databases, thereby reducing the time required for the actual vulnerability detection process.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If manual SQL queries are implemented to handle edge-cases and reduce false-positives, then detection precision may improve, but the device complexity and difficulty of operation increase

Engineering Contradiction:
Improvefalse-positive rateVSAvoidnumber of SQL queries required
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system uses a universal automated query generation mechanism that handles all edge-cases through standardized attribute comparison logic. Instead of requiring multiple specialized SQL queries for different scenarios, a single automated process adapts to various dependency types and vulnerability patterns, reducing system complexity while maintaining precision through consistent application of matching rules.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system replaces manual mechanical query construction with an automated computational process. The automated system generates and executes SQL queries based on dependency attributes, eliminating the need for manual query writing and adjustment. This substitution reduces operational complexity and makes the system easier to operate while maintaining or improving detection precision through systematic attribute matching.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If comprehensive vulnerability monitoring is performed to reduce security risks, then reliability improves, but productivity decreases due to substantial man hours required

Engineering Contradiction:
Improvesecurity risk reductionVSAvoidman hours required
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system performs comprehensive vulnerability monitoring automatically without requiring manual intervention. The automated process extracts dependency information, generates queries, matches vulnerabilities, and produces results independently, eliminating the need for substantial man hours while maintaining comprehensive security coverage. This self-service approach preserves reliability through thorough monitoring while dramatically improving productivity.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system replaces manual vulnerability monitoring processes with an automated computational system. The automated generation and execution of SQL queries, along with automatic vulnerability matching and reporting, substitutes human labor with machine processing. This substitution maintains comprehensive security monitoring for reliability while reducing the time and effort required, thereby improving overall productivity.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12386975B2Method for finding vulnerabilities in a software project
Publication Date: 2025.08.12 DEBRICKED AB
  • US12386975B2 patent drawing
  • US12386975B2 patent drawing
  • US12386975B2 patent drawing

AI summary

A method (500) for finding vulnerabilities in a software project. The method (500) comprising receiving (S502) a dependency file (202), specifying software components related to the software project; extracting (S506) information from the dependency file (202) using a dependency file parser (204), wherein the dependency file parser (204) is configured for a programming language of the dependency file (202), and wherein the extracted information comprises one or more dependency attributes; generating (S508) a first dependency common platform enumeration, CPE, (206) based on the one or more dependency attributes; receiving (S510) vulnerability CPEs (210) from a vulnerability database, VD, (212) wherein the vulnerability CPEs (210) comprises one or more vulnerability attributes; generating (S512) a first condensed dataset (214) of vulnerability CPEs by selecting the vulnerability CPEs (210) that has at least one vulnerability attribute that matches at least one dependency attribute in the first dependency CPE (206); evaluating (S514) the vulnerability CPEs from the first condensed dataset (214) of vulnerability CPEs by determining a confidence score for each vulnerability CPE, wherein the confidence score is an estimate of a probability of the vulnerability CPE being relevant to the software project; generating (S516) a second condensed dataset (218) of vulnerability CPEs, wherein the second condensed dataset (218) is smaller than the first condensed dataset (214), from the first condensed dataset of vulnerability CPEs by selecting the vulnerability CPEs that has a confidence score above a threshold.