Open Source Verification Using Dynamic Binary Instrumentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for verifying the use of open source software components in software are inefficient and costly, particularly when the open source code is modified or lacks accurate version information, leading to difficulties in identifying vulnerabilities and managing dependencies effectively.

Innovation Solution

A method and apparatus using dynamic binary instrumentation (DBI) tools to probabilistically verify the presence of open source components by inputting data into software modules, collecting and vectorizing data sets, and measuring similarity between these sets to generate a verification result.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static analysis of binaries is used to verify open source software, then vulnerability identification can be performed, but the process requires a lot of time and cost

Engineering Contradiction:

Improvevulnerability identificationVSAvoidanalysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent replaces static binary analysis with dynamic execution tracing. Instead of mechanically decompiling and comparing binary code structures, the system dynamically executes the target software with fuzzed inputs and traces runtime behavior (system calls, memory access patterns, CPU instructions). This substitution of static mechanical analysis with dynamic execution tracing significantly reduces analysis time while maintaining vulnerability detection capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the analysis parameter from code structure similarity (static) to runtime behavior characteristics (dynamic). By collecting execution traces, system call sequences, and memory access patterns during software execution, the system transforms the verification approach from analyzing fixed binary structures to observing dynamic runtime behavior, thereby reducing computational complexity and analysis time.

Inventive Principle:

Principle #35Parameter changes

2Device complexity

If hash digest values are used in SBOM to manage open source components, then dependency tracking is simplified, but accurate component identification becomes difficult when open source code is modified or reused

Engineering Contradiction:

Improvedependency managementVSAvoidcomponent identification accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The patent introduces dynamic execution tracing to capture runtime behavior characteristics of software components. Instead of relying on static hash values that break with modifications, the system dynamically observes execution traces, system calls, and memory access patterns during software operation. This dynamic approach allows accurate identification of open source components even when their code has been modified, reused, or obfuscated, as the runtime behavior remains characteristic of the underlying open source library.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent uses execution traces and runtime behavior as an intermediary between the modified open source code and the SBOM. Rather than directly comparing code hashes (which fail with modifications), the system traces the runtime behavior of executed code and uses these traces as intermediaries to identify and track open source components, their versions, and their usage in the target software system.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If open source code is modified and integrated into target software, then functionality is enhanced, but verification of original open source version and hash values becomes unreliable

Engineering Contradiction:

Improvecode reusabilityVSAvoidversion verification

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent employs dynamic execution tracing to verify open source components at runtime rather than relying on static version information. By instrumenting the software execution and collecting runtime behavior (system calls, memory access, CPU instructions), the system can identify open source components and their effective versions even when the code has been modified. This dynamic verification maintains reliability despite code modifications, allowing the system to detect when open source components are used and in what effective version.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS20260044431A1Method and apparatus for verifying use of open source software

Publication Date: 2026.02.12 ELECTRONICS & TELECOMM RES INST

AI summary

Provided are a dynamic analysis method and an apparatus for verifying use of open source software, in which a computer-implemented method for verifying whether open source software is used includes inputting input data from a fuzzer to one or more software modules, collecting data sets generated during a process in which the software module processes the input data, vectorizing the collected data sets, measuring a similarity between the vectorized data sets, and generating a verification result based on the similarity.