Distributed Code Repository Scanning Across Branches and SCMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automated software security scanning techniques are inefficient for large-scale distributed code repositories, requiring years to complete scans of tens of thousands of codebases and are limited by vendor-specific SCM systems, leading to incomplete analyses.
Innovation Solution
A method involving copying codebase branches into a clone database and launching container tasks for simultaneous scanning operations, analyzing without compilation, and generating scan results, allowing centralized, efficient scanning across multiple SCM systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing automated software security scanning techniques are used to scan large-scale distributed code repositories, then scanning completeness is improved, but scanning time increases to years or decades
Solution Approach 1:
The patent divides the large-scale code repository scanning task into multiple parallel scanning operations. Each scanning operation processes a subset of codebases simultaneously using multiple computing resources, thereby reducing the total scanning time from years to a manageable period while maintaining comprehensive coverage of all codebases.
Solution Approach 2:
The patent introduces parallelism as a new dimension for scanning operations. By executing multiple scanning tasks concurrently across distributed computing resources rather than sequentially, the system achieves both complete scanning coverage and reduced scanning time, resolving the contradiction between thoroughness and speed.
2Measurement precision
If existing automated software security scanning techniques are customized for each vendor-specific SCM system, then scanning accuracy is improved, but system complexity increases requiring substantial re-configuration
Solution Approach 1:
The patent creates a universal scanning system that can handle multiple vendor-specific SCM systems through a common interface layer. This universal architecture allows the system to scan codebases from different SCM vendors without requiring substantial re-configuration, thereby reducing system complexity while maintaining the ability to accurately scan various codebase formats.
Solution Approach 2:
The patent introduces an intermediary layer between the scanning engine and vendor-specific SCM systems. This intermediary handles the adaptation and translation between different SCM formats and the scanning operations, allowing the core scanning logic to remain simple and unified while supporting multiple vendors, thus reducing overall system complexity.
3Productivity
If existing automated software security scanning techniques scan a single codebase branch, then scanning speed is improved, but scanning completeness deteriorates
Solution Approach 1:
The patent segments the codebase into multiple branches and processes them in parallel through separate scanning operations. Each branch is scanned independently and simultaneously, maintaining high scanning speed while ensuring that all branches across all codebases are comprehensively analyzed, thereby achieving both speed and completeness.
Solution Approach 2:
The patent ensures continuous scanning operations across multiple branches by launching parallel scanning tasks that operate simultaneously without idle time. This continuous parallel processing maintains high productivity while ensuring complete coverage of all codebase branches, resolving the contradiction between speed and completeness.
Data Source
AI summary
The present invention sets forth a technique for performing automated software security scanning. The method includes copying a plurality of codebase branches included in a code repository into a clone database, based on one or more scripts included in a script database. The method also includes simultaneously executing one or more scanning operations on each of the plurality of codebase branches via a plurality of processing threads and generating one or more scan results based on the one or more scanning operations executed on the plurality of codebase branches.