Dynamic SBOM Generation for Runtime Dependency Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software bill of materials (SBOM) technologies face challenges in generating dynamic SBOMs that identify all potentially exploitable dependencies of a software application during runtime, leading to false positives and negatives in vulnerability detection, as static SBOMs cannot account for hidden or loaded dependencies.
Innovation Solution
An SBOM-reporting software module is embedded in software applications to generate and report dynamic SBOM data, including all accessible and currently loaded dependencies, which can be uploaded to a central server for collection and storage, using standardized formats like JSON, enabling real-time identification of potentially exploitable dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static SBOM methods are used to inventory software components, then the SBOM can be generated at compile-time or build-time, but it cannot identify hidden or loaded dependencies that are only accessible during runtime, leading to false negatives in vulnerability detection
Solution Approach 1:
The patent transitions from static SBOM generation to dynamic SBOM generation by embedding SBOM-reporting code within the software application itself. This code executes at runtime to identify actually loaded dependencies, transforming the SBOM from a compile-time snapshot to a runtime reflection of actual dependency usage, thereby resolving the contradiction between measurement precision and reliability
Solution Approach 2:
The software application itself generates its own SBOM by including SBOM-reporting code that monitors its own dependency loading at runtime. This self-service approach eliminates the need for external static analysis tools and enables the application to accurately report its actual dependency state, solving the false negative problem
2Productivity
If static SBOM analysis is performed, then the process can be completed at compile-time without runtime overhead, but it produces false positives by including dependencies that are never actually loaded or executed during runtime
Solution Approach 1:
The patent implements dynamic SBOM generation that runs at runtime to identify actually loaded dependencies, filtering out false positives by only reporting dependencies that are actively used during execution. This dynamic approach trades some runtime overhead for significantly improved accuracy in identifying active dependencies
3Measurement precision
If comprehensive dependency tracking is implemented to capture all loaded dependencies, then vulnerability detection accuracy improves, but the complexity of the SBOM generation process increases
Solution Approach 1:
The patent simplifies the overall system architecture by having the software application itself generate its SBOM through embedded SBOM-reporting code. This self-service mechanism eliminates the need for complex external analysis tools and infrastructure, reducing system complexity while maintaining comprehensive dependency tracking capability
Data Source
AI summary
Disclosed is an SBOM-reporting software program product that generates dynamic software bill of materials (SBOM) data for a software application during execution of the software application. Dynamic SBOM data identifies currently loaded dependencies of the software application. The program instructions for generating dynamic SBOM data are included in the software application. Also disclosed is a computer system for locating potentially-exploitable software dependencies comprising one or more computers comprising one or more SBOM-reporting software applications programmed to generate dynamic SBOM data. The computer system includes an SBOM server that can request of receive dynamic SBOM data from the SBOM-reporting software applications and may also include an SBOM collector that collects dynamic SBOM data from the SBOM-reporting applications.