Runtime Fingerprinting for Third-Party SBOM Generation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing techniques for generating a software bill of materials (SBOM) require access to internal code and documentation of a software application, which is not available to third parties, hindering their ability to analyze and address security vulnerabilities.

Innovation Solution

An adversarial technique involving scanning and fingerprinting a software application externally to identify components and subcomponents, utilizing open source software structural information to generate an SBOM without internal data, and generating a standardized format compatible with security tools.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If existing techniques are used to generate SBOM, then the SBOM can be generated with high accuracy, but internal code and documentation must be accessible which limits applicability to third parties

Engineering Contradiction:

Improveapplicability to third partiesVSAvoidunavailability of internal code and documentation

Core Design Contradiction:

Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent uses executable code as an intermediary to access software application information indirectly. Instead of requiring direct access to internal code and documentation, the system executes the software application and captures its runtime behavior, using the executable code as a mediator to extract component information without needing internal access.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical approach of directly accessing internal code and documentation with a dynamic execution-based approach. Instead of statically analyzing source code files, the system dynamically executes the software application and observes its runtime behavior to infer component structure, substituting direct access mechanisms with execution observation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If internal code and documentation are required for SBOM generation, then comprehensive component information can be obtained, but the process becomes inaccessible to external analysts and security researchers

Engineering Contradiction:

Improveaccessibility to third partiesVSAvoidcomplexity of access requirements

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The software application itself provides the necessary information for SBOM generation through its own execution. By running the application and capturing its runtime behavior, component names, versions, and relationships are automatically revealed without requiring external access to internal documentation. The application serves its own informational needs.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent changes the state parameters from static code analysis to dynamic execution observation. Instead of analyzing fixed source code files and documentation, the system observes changing parameters during runtime execution such as memory allocations, process creation, and library loading to infer component information.

Inventive Principle:

Principle #35Parameter changes

3Loss of information

If dynamic scanning and fingerprinting are performed externally, then SBOM can be generated without internal access, but the process requires sophisticated execution monitoring capabilities

Engineering Contradiction:

Improveaccess to internal dataVSAvoidcomplexity of scanning and fingerprinting system

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The system uses feedback from software application execution to identify components. By monitoring runtime behavior and comparing observed patterns against known component fingerprints, the system automatically identifies software components and their versions, using the execution feedback loop to resolve component information without internal access.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250356023A1Adversarial generation of software bill of materials (SBOM) for computing security

Publication Date: 2025.11.20 INTUIT INC

AI summary

Aspects of the present disclosure provide techniques for adversarial software intelligence document generation. Embodiments include scanning, by a computing device, a software application during execution of the software application on a server that is remote from the computing device to determine application attributes and fingerprinting the software application based on the application attributes in order to determine a component application of the software application. Embodiments include utilizing a database of open source software structural information to determine one or more subcomponent applications of the component application and generating, by the computing device, a software intelligence document indicating the component application and the one or more subcomponent applications in a standardized software intelligence document format. Embodiments include performing one or more actions related to computing security based on the software intelligence document.