Framework-Aware Runtime RBOM from Executed Code Sections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently identifying and maintaining an up-to-date list of active software modules within computer systems, which is crucial for security and management, as many software components are rarely or never invoked, leading to resource-intensive security maintenance tasks.
Innovation Solution
The system employs memory forensics to identify active code sections by analyzing memory spaces of processes, utilizing framework-specific structures and indicators to determine executed code sections, and construct a runtime bill-of-materials (RBOM) by adding code section identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If memory forensics is used to identify active code sections, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent introduces code section description structures as intermediary data structures that mediate between the complex memory space and the identification process. These structures contain execution indicators that simplify the detection of active code sections, allowing the system to achieve high measurement precision without directly analyzing the entire complex memory space.
2Reliability
If all software modules are monitored for security, then reliability is improved, but use of energy increases
Solution Approach 1:
The patent extracts only the relevant information needed for security monitoring by identifying and tracking only active code sections through execution indicators in memory structures. This extraction approach maintains comprehensive security coverage for actually executing code while ignoring inactive modules, thereby reducing the computational energy required compared to monitoring all software modules.
3Measurement precision
If runtime monitoring is performed continuously, then measurement precision is improved, but loss of time increases
Solution Approach 1:
The patent prepares code section description structures with execution indicators in advance during program execution. These pre-prepared structures contain ready-to-use information about active code sections, allowing the system to achieve real-time measurement precision without performing continuous complex analysis, thus reducing processing time overhead.
Data Source
AI summary
A system of determining a software runtime bill-of-materials (RBOM) of an operating environment, the system comprising a processing circuitry configured to: a) identify a first software process executing in the operating environment; b) determine, from data or metadata of a file associated with the first software process, a software framework of the first software process; c) for each of one or more runnable files located in the operating environment and associated with the identified software framework: determine, from metadata associated with the runnable file, a respective time of most recent access of the runnable file, and responsive to the respective time of most recent access of the runnable file being later than a start time of the first software process: adding a respective file path of the runnable file to the RBOM.