Enriching Software Dependency Graphs with Time-Sensitive Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current dependency graphs in software ecosystems are limited in their ability to incorporate and query time-related metrics, such as security vulnerabilities, artifact freshness, and release speed, and they cannot track prior states of the ecosystem.
Innovation Solution
A dependency graph metamodel that includes time-related information, along with a tool to dynamically enrich queries on dependency graphs, allowing for the retrieval of subgraphs, incorporation of security vulnerabilities, and computation of additional metrics such as CVEs, freshness, and release speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If metrics are incorporated into the dependency graph, then query capability is improved, but device complexity increases
Solution Approach 1:
The patent segments the dependency graph into multiple layers: the core dependency graph structure and separate metric layers. Metrics are not embedded directly in the graph nodes and edges, but are stored separately and associated through the query mechanism, reducing graph complexity while maintaining query capability.
Solution Approach 2:
The patent introduces an intermediary metric association mechanism that connects the dependency graph with metric data. This intermediary layer allows metrics to be queried without being directly integrated into the graph structure, resolving the contradiction between query capability and graph complexity.
2Measurement precision
If comprehensive metrics are included in queries, then measurement precision is improved, but loss of time increases
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing metric values in the dependency graph system. Metrics such as vulnerability counts, freshness indicators, and release speeds are calculated in advance and cached, allowing fast retrieval during queries without real-time computation overhead.
Solution Approach 2:
The patent implements dynamic metric computation that adapts to query requirements. The system computes only the necessary metrics for the specific query being executed, rather than retrieving all available metrics, thus balancing measurement precision with query execution time.
3Adaptability or versatility
If time-related information is added to the metamodel, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent adds a time dimension to the dependency graph metamodel by introducing temporal properties to nodes and edges. This allows the graph to represent not only dependency relationships but also their evolution over time, enabling temporal queries without fundamentally restructuring the core metamodel.
Solution Approach 2:
The patent creates a universal time-related information structure that can be applied to different types of metrics and queries. The temporal metamodel elements are designed to be generic and reusable across various analysis scenarios, reducing the need for separate complex structures for each temporal query type.
Data Source
AI summary
Systems and methods include reception of a query of a dependency graph and a metric, the dependency graph comprising a first plurality of nodes representing code artifacts and a second plurality of nodes representing code artifact releases conforming to a first programming language, querying of the dependency graph with the query, receipt, in response to the query, a result set of nodes of the dependency graph, determination of values of the metric for each of the nodes of the result set of nodes, determination of an output based on the result set of nodes and the determined values, and presentation of the output.