Automated SBOM Vulnerability Monitoring System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to provide an automated and continuous monitoring system for newly-discovered security vulnerabilities in third-party software components used in software applications, which are critical for timely risk management and compliance with licensing requirements.
Innovation Solution
A computer-implemented method and system that continuously monitors third-party software components for known and newly-discovered vulnerabilities by comparing software bill of materials (SBOM) lists, generating notifications when differences are detected, and utilizing external vulnerability databases like NVD, Sonatype OSS, and CVE databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If SCA tools are used to analyze third-party components, then vulnerability detection capability is improved, but manual review and analysis time are increased
Solution Approach 1:
The system performs preliminary automated analysis using SCA tools to generate vulnerability lists before manual review, pre-processing the data to identify and flag potential issues. This preliminary action reduces the scope and time required for subsequent manual verification by focusing human expertise on critical findings rather than exhaustive review.
Solution Approach 2:
The patent introduces an intermediary automated comparison system that bridges SCA tool output and manual review processes. This intermediary layer automatically compares vulnerability lists across different scans, identifies new versus known vulnerabilities, and prioritizes findings, serving as a mediator that reduces manual workload while maintaining detection precision.
2Reliability
If continuous monitoring of third-party components is implemented, then security risk management is improved, but system complexity and resource consumption are increased
Solution Approach 1:
The system implements periodic vulnerability scanning at scheduled intervals rather than continuous monitoring, automatically comparing each scan's results against previous scans. This periodic approach maintains security risk management by detecting new vulnerabilities while reducing system complexity by allowing the monitoring infrastructure to reset and resource consumption to decrease between scan cycles.
Solution Approach 2:
The monitoring system is segmented into modular components: SCA tool execution, vulnerability list generation, comparison logic, and notification systems. Each component operates independently and can be configured separately, reducing overall system complexity while enabling continuous monitoring capability through composition of simpler, manageable segments.
3Productivity
If automated vulnerability analysis is performed on all third-party components, then detection speed is improved, but false positives and analysis errors are increased
Solution Approach 1:
The system incorporates feedback loops where automated analysis results are compared against known vulnerability databases and previous scan results. False positives are identified through this feedback mechanism by checking whether detected vulnerabilities actually represent new security issues or known benign conditions, allowing the system to learn and improve accuracy while maintaining high detection speed through automated processing.
Solution Approach 2:
The analysis system dynamically adjusts its detection thresholds and scanning depth based on component criticality, change frequency, and historical vulnerability patterns. High-risk components receive more intensive automated analysis while lower-risk components use lighter scanning, optimizing detection speed while maintaining accuracy by concentrating automated analysis resources where they are most needed rather than uniformly applying them to all components.
Data Source
AI summary
A method, system and computer program product for automatically and continuously monitoring security vulnerabilities in software applications with third-party components and reporting newly-discovered vulnerabilities in the third-party software components used by a software application is provided. The method includes receiving a software bill of materials (SBOM) including a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components of the SBOM for known vulnerabilities and generating a first list of known vulnerabilities; storing the first list of known vulnerabilities; automatically analyzing, after a first period of time, each of the plurality of third-party components identified in the SBOM for newly-discovered vulnerabilities; storing a compiled second list of known vulnerabilities; comparing the compiled second list of known vulnerabilities with the original list of known vulnerabilities; and in response to the second list differing from the original list, transmitting, through a network, a notification identifying a set of differences in vulnerabilities between the second list and the original list.