Open Source Code Detection via Local Characteristic Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in detecting and identifying open source code within a user's codebase, determining the associated open source projects, and their licenses, while avoiding the need to copy or transmit the user's code externally, thus preventing copyright infringement and security risks.
Innovation Solution
A method and system that create a repository of known open source projects with unique characteristics, using hash functions and keyword sequences to identify matching code within the user's codebase without leaving the network, allowing for non-intrusive detection and compliance with licensing requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If open source code is used in a user's codebase, then programming time and effort are saved, but copyright and license compliance risks increase
Solution Approach 1:
The system performs preliminary detection of open source code usage in the codebase before compliance issues arise. By proactively identifying open source components and their licenses, the system enables organizations to take preventive action to ensure compliance, rather than reacting to compliance failures after they occur.
Solution Approach 2:
The system provides continuous feedback about open source usage and license compliance status. This feedback mechanism allows organizations to monitor their compliance situation in real-time and make informed decisions about code usage, modifications, and distribution to maintain license compliance.
2Measurement precision
If the user's codebase is analyzed to detect open source usage, then compliance accuracy is improved, but communication and storage resources are consumed
Solution Approach 1:
The system extracts only the necessary characteristic information from the codebase for comparison, rather than transmitting or storing the entire codebase. This extraction approach maintains high detection accuracy by focusing on distinctive code features while minimizing communication and storage resource consumption.
Solution Approach 2:
The system creates simplified copies or representations of code characteristics (such as hash values or feature vectors) for comparison purposes. These lightweight copies enable accurate matching and compliance detection without requiring the storage or transmission of the actual source code, thereby reducing resource consumption.
3Difficulty of detecting and measuring
If the user's code is transmitted externally for analysis, then open source detection capability is improved, but copyright infringement and security risks increase
Solution Approach 1:
The system acts as an intermediary by performing local analysis of code characteristics and comparing them against a database of known open source patterns. This intermediary approach enables effective open source detection without requiring the transmission of proprietary code to external parties, thus maintaining both detection capability and code security.
Solution Approach 2:
The system segments the detection process into local characteristic extraction and remote pattern matching. By dividing the analysis into these separate stages, the system can perform detailed local analysis on code characteristics without transmitting the actual source code, thereby maintaining detection effectiveness while preventing copyright infringement and security vulnerabilities.
Data Source
AI summary
A method, system and computer program product, the method comprising: receiving a characteristic of a source code entity to be checked; comparing the characteristic of the source code entity to be checked to characteristics stored in a repository; and subject to determining with at least a first probability that the characteristic of the source code entity to be checked is found in the repository, providing an indication of an open source library associated with the characteristic, wherein the source code entity to be checked is not received with the characteristic.