Runtime Bill-of-Materials via Memory Forensics

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems face challenges in efficiently identifying and maintaining an up-to-date list of active software modules within computer systems, particularly in managed software frameworks, which is crucial for security and maintenance.

Innovation Solution

A system and method to identify active code sections by accessing memory spaces, detecting software frameworks, and using code section execution indicators (CSEIs) to construct a runtime bill-of-materials (RBOM) for managed software environments, including frameworks like Java, node.js, and Python.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional methods are used to identify active code sections, then security and maintenance efforts can be performed, but the process is inefficient and time-consuming

Engineering Contradiction:

Improveefficiency of identifying active code sectionsVSAvoidtime required to maintain list of active modules

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by continuously monitoring and identifying active code sections in real-time during software execution. Code section execution indicators are updated as code is executed, so when security or maintenance operations are needed, the current list of active modules is already available immediately without requiring time-consuming analysis.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If comprehensive monitoring of all code sections is performed, then complete security coverage is achieved, but system complexity and resource consumption increase

Engineering Contradiction:

Improvecompleteness of security coverageVSAvoidcomplexity of monitoring system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts only the essential information needed for security and maintenance by focusing on code section execution indicators rather than monitoring all code sections in detail. By taking out only the relevant execution status data from the memory space, the system achieves complete security coverage while minimizing system complexity and resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If real-time identification of active code sections is implemented, then up-to-date security measures can be applied, but additional processing resources are required

Engineering Contradiction:

Improvecurrentness of security measuresVSAvoidprocessing resources consumed

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system utilizes self-service by leveraging existing code execution mechanisms and memory structures already present in the software framework. By reading execution indicators from existing data structures in memory and using the framework's own execution information, the system achieves real-time identification with minimal additional processing resources.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20250322355A1Identifying active code sections via memory forensics

Publication Date: 2025.10.16 KODEM SECURITY LTD

AI summary

A system of determining a software bill-of-materials (RBOM) of an operating environment, the system comprising a processing circuitry configured to: a) access a memory space of a first process executing in the operating environment; b) for one or more threads of the first process: read contents of one or more memory location of a thread stack associated with the respective thread, determine whether a contained value of a respective memory location is a code section execution address, and responsive to the contained value of the respective memory location of the thread stack being a code section execution address: i) determine, based on the memory space of the first process and/or an executable file associated with the first process, a code section identifier associated with the code section, and ii) add the code section identifier associated with the code section to the RBOM.