SBOM Accuracy Assessment via Dependency Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software bill of materials (SBOM) assessment tools face challenges in ensuring the accuracy and completeness of SBOMs, which can lead to misjudged security risks due to incomplete or inaccurate dependency information.
Innovation Solution
A method and system for assessing SBOMs by extracting package names from application code and accesses to identify dependencies, generating a quality score based on the comparison of actual dependencies to the SBOM contents, and performing actions responsive to the quality score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If SBOM is generated from software components, then software transparency is improved, but accuracy and completeness of dependency information deteriorates
Solution Approach 1:
The system performs iterative refinement by comparing extracted dependencies against the SBOM and using the quality score to guide further analysis. The feedback loop continues until the quality score meets a threshold or maximum iterations are reached, progressively improving accuracy while maintaining transparency.
Solution Approach 2:
The patent replaces manual SBOM verification processes with automated static analysis and machine learning-based quality assessment. This substitution enables systematic extraction of dependencies from code and automated comparison, significantly improving measurement precision without sacrificing transparency.
2Quantity of substance
If SBOM includes all dependencies, then completeness is improved, but complexity of verification deteriorates
Solution Approach 1:
The verification process is segmented into distinct phases: extraction of dependencies from code, comparison with SBOM contents, generation of quality scores, and iterative refinement. This segmentation breaks down the complex verification task into manageable steps, handling complete dependency lists systematically.
Solution Approach 2:
The patent introduces an intermediary quality score mechanism that mediates between the complete dependency list and the verification process. The quality score provides a quantitative measure that simplifies the assessment of SBOM completeness, making the verification of extensive dependency lists more manageable.
3Measurement precision
If manual verification of SBOM is performed, then accuracy is improved, but productivity deteriorates
Solution Approach 1:
The system performs self-service verification by automatically extracting dependencies from code, comparing them against the SBOM, and generating quality scores without human intervention. This automated self-verification maintains high accuracy while dramatically improving productivity compared to manual processes.
Solution Approach 2:
Manual verification activities are replaced with automated static analysis tools and machine learning models that can process SBOMs rapidly. The substitution maintains measurement precision through systematic analysis while improving productivity by eliminating time-consuming manual review processes.
Data Source
AI summary
Methods and systems for assessing a software bill of materials (SBOM) include extracting package names from code of an application to identify first dependencies of the application. Package names are extracted from accesses by the application to identify second dependencies of the application. A quality score is generated for an SBOM of the application based on a comparison of the contents of the SBOM to the first dependencies and the second dependencies. An action is performed responsive to the quality score.