OSS Library Identification via Function Prefix Matching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current solutions for identifying vulnerabilities in open source software (OSS) libraries are prone to false positives and negatives, and the sheer volume of vulnerabilities across OSS libraries creates challenges, with potential risks of malicious code and unpatched vulnerabilities affecting many applications.

Innovation Solution

A method and system using a tree-like data structure to efficiently match function identifiers to OSS libraries, determining risk levels, and identifying vulnerabilities by querying a vulnerability database based on library information, rather than identifiers, thereby reducing resource-intensive scanning and improving accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If automated tools like static analysis and dependency scanning are used to identify vulnerabilities in OSS, then vulnerability detection capability is improved, but false positives and false negatives increase

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidaccuracy of vulnerability identification

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary mapping system that connects OSS library identifiers to function identifiers through a structured database. This intermediary layer translates automated scanning results into precise library-level vulnerability identification, reducing false positives and negatives by providing a reliable mapping mechanism between code functions and their source libraries.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces manual or mechanical vulnerability analysis with an automated mapping system that uses data structures (such as hash maps or dictionaries) to efficiently match function identifiers to library identifiers. This substitution enables scalable, accurate vulnerability detection without the imprecision of traditional static analysis tools.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If comprehensive vulnerability scanning is performed across all OSS libraries, then vulnerability coverage is improved, but computing resources are excessively consumed

Engineering Contradiction:

Improvevulnerability coverageVSAvoidcomputing resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the essential mapping information (function identifier to library identifier relationships) from the complex OSS ecosystem into a compact data structure. This extraction allows the system to achieve comprehensive vulnerability coverage by querying only the extracted mapping data rather than performing exhaustive scans of all library code, significantly reducing computing resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent performs preliminary action by pre-establishing the mapping between function identifiers and library identifiers during a setup phase. This pre-computed mapping is stored in an efficient data structure that enables rapid querying during vulnerability assessment, eliminating the need for resource-intensive real-time analysis of all OSS libraries.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If detailed analysis of OSS code is performed to reduce false positives, then measurement precision is improved, but processing time increases

Engineering Contradiction:

Improveaccuracy of vulnerability identificationVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent creates a simplified copy or representation of the OSS library structure through identifier mapping, where function identifiers are linked to library identifiers without requiring detailed code analysis. This copied mapping structure enables rapid, accurate vulnerability identification by referencing pre-established relationships rather than performing time-consuming code examinations.

Inventive Principle:

Principle #26Copying

4Measurement precision

If manual auditing of OSS libraries is performed to ensure security, then measurement precision is improved, but productivity decreases

Engineering Contradiction:

Improveaccuracy of vulnerability identificationVSAvoidvulnerability assessment speed

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent implements a self-service system where the mapping between function identifiers and library identifiers is automatically established and maintained through programmatic analysis. This automated mapping infrastructure enables rapid vulnerability assessment without requiring manual auditing, as the system can quickly query the pre-built mapping structures to identify affected libraries with high precision and speed.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12517706B1System and method for identifying libraries for application runtime environment

Publication Date: 2026.01.06 R C RAVEN CLOUD LTD

AI summary

A system and method for identifying open source software (OSS) libraries for an application runtime environment is presented. The method includes receiving an identifier representing a function of the application runtime environment as a sequence of bits; querying a tree-like data structure using the received identifier; matching a portion of the identifier to a first key of the data structure that has a prefix of the identifier; and identifying a library of the function represented by the received identifier.