Runtime SBOM Dependency Updates for Software Vulnerability Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
End users indiscriminately apply software updates, wasting resources and impacting performance in complex computing environments by updating non-essential software components.
Innovation Solution
A computing environment monitors software usage to identify and update only the dependencies that are actually invoked, using a software bill of materials (SBOM) and vulnerability databases to target updates, minimizing downtime and resource waste.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software updates are applied indiscriminately to all dependencies, then vulnerabilities are addressed, but computing resources are wasted and performance is impacted
Solution Approach 1:
The patent segments the software dependencies into two categories: those actually invoked by the software program and those that are not. By monitoring runtime behavior and analyzing call graphs, the system identifies only the subset of dependencies that are actively used, then applies vulnerability updates selectively to this segment rather than universally to all dependencies. This segmentation resolves the contradiction by maintaining security for used components while avoiding resource waste on unused ones.
Solution Approach 2:
The patent applies local quality by treating different dependencies differently based on their actual usage status. Used dependencies receive security updates to ensure vulnerability mitigation, while unused dependencies are left unchanged to conserve computing resources. This differentiated approach allows the system to optimize security measures locally where needed rather than applying uniform updates everywhere, thus resolving the trade-off between reliability and resource efficiency.
2Reliability
If software updates are applied indiscriminately to all dependencies, then vulnerabilities are addressed, but update time and downtime increase
Solution Approach 1:
The patent segments the update process into two phases: a monitoring phase that identifies actually-used dependencies during runtime, and an update phase that applies security patches only to this identified subset. By segmenting the update scope based on runtime behavior analysis, the system reduces the total number of updates required, thereby decreasing both update execution time and service downtime while maintaining effective vulnerability mitigation for the used components.
Solution Approach 2:
The patent performs preliminary monitoring and analysis of software behavior before applying updates. By tracking dependency invocation during a monitoring period and analyzing call graphs in advance, the system identifies which dependencies actually need updating before the update process begins. This preliminary action reduces unnecessary updates and minimizes the time required for the actual update deployment, thus resolving the contradiction between security and update time.
3Reliability
If all dependencies are updated, then security is improved, but resource consumption increases
Solution Approach 1:
The patent segments the set of all dependencies into used and unused subsets by monitoring runtime behavior and analyzing execution traces. Security resources are then concentrated on updating only the used subset, while unused dependencies are excluded from the update process. This segmentation ensures that computing resources for vulnerability scanning, patch application, and validation are expended only where necessary, maintaining security for active components while reducing overall resource consumption.
Solution Approach 2:
The patent applies local quality by tailoring security update efforts to the specific usage characteristics of each dependency. Dependencies that are actively invoked receive comprehensive security updates including vulnerability scanning and patching, while unused dependencies are exempted from these resource-intensive operations. This localized approach to security maintenance optimizes the balance between security improvement and resource consumption by applying security measures only where they provide actual value.
Data Source
AI summary
In one example, a system can execute a first version of a software program during a time window. While executing the first version of the software program during the time window, the system can generate a software bill of materials (SBOM) for the software program. The SBOM can identify a dependency relied upon by the first version of the software program during the time window. The system can determine that the dependency has a vulnerability based on a Common Vulnerabilities and Exposures (CVE) record associated with the dependency. The system can then obtain an updated version of the dependency that lacks the vulnerability, generate a second version of the software program using the updated version of the dependency to mitigate the vulnerability, and deploy the second version of the software program. The system may also shut down the first version of the software program.