SBOM Accuracy Assessment via Knowledge Graph Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software bill of materials (SBOM) assessment tools face challenges in ensuring the accuracy and completeness of SBOMs, which can lead to misidentification of security risks due to incomplete or inaccurate dependency declarations.
Innovation Solution
A method and system for assessing SBOMs by building a knowledge graph from software repositories using function fingerprints, identifying application dependencies, and generating a quality score based on comparisons with claimed dependencies, thereby enabling accurate and complete SBOM assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional SBOM generation methods are used, then the process is simple and fast, but the accuracy and completeness of dependency identification is insufficient
Solution Approach 1:
The patent introduces a knowledge graph as an intermediary data structure that mediates between the software application and the SBOM. The knowledge graph stores function fingerprints and dependency relationships, enabling accurate dependency identification without directly analyzing the entire application codebase. This intermediary layer resolves the contradiction by providing precise measurement through structured intermediate representations.
Solution Approach 2:
The patent replaces traditional mechanical parsing methods with function fingerprinting and graph-based analysis. Instead of manually parsing code or relying on simple metadata extraction, the system uses automated fingerprint generation and knowledge graph traversal to identify dependencies. This substitution enables higher accuracy while managing complexity through algorithmic approaches.
2Reliability
If comprehensive dependency analysis is performed to ensure completeness, then the SBOM becomes more accurate, but the assessment time and computational resources increase
Solution Approach 1:
The patent performs preliminary action by pre-building the knowledge graph with function fingerprints and dependency relationships before actual SBOM assessment. This pre-processing stores analyzed dependency information in an optimized structure, enabling fast queries during assessment without re-analyzing the entire application. The knowledge graph is constructed once and reused for multiple assessment operations.
Solution Approach 2:
The patent applies partial action by focusing the assessment on critical dependency paths and high-risk components rather than exhaustively analyzing all dependencies. The knowledge graph enables targeted queries that identify only the necessary dependency relationships for security assessment, reducing computational overhead while maintaining completeness for relevant components.
3Measurement precision
If manual verification of SBOM is performed to ensure accuracy, then the quality improves, but the process becomes time-consuming and labor-intensive
Solution Approach 1:
The patent implements self-service by enabling the system to automatically verify SBOM quality against the knowledge graph without requiring manual intervention. The automated comparison of function fingerprints and dependency declarations provides consistent, repeatable assessment results. The system self-verifies accuracy by cross-referencing claimed dependencies with the pre-computed knowledge graph, eliminating manual verification while maintaining high quality.
Data Source
AI summary
Methods and systems for assessing a software bill of materials (SBOM) include building a knowledge graph from repositories, using function fingerprints of software packages in the repositories. Dependencies of an application are identified using function fingerprints of the application and comparing to function fingerprints of the software packages. A quality score for an SBOM of the application is generated based on a comparison of the identified dependencies to claimed dependencies of the SBOM. An action is performed responsive to the quality score.