Software Composition Analysis Mapping Source Code Snippets

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current software composition analysis (SCA) techniques struggle to credibly include Internet-based community-driven platforms, such as StackOverflow, in the analysis of target source code, leading to potential security vulnerabilities and license compliance issues.

Innovation Solution

A computer-implemented method that performs SCA by searching both open source code archives and Internet-based community-driven platform archives, collecting key information about matching source code snippets, mapping these snippets to their original sources, and filtering out earlier versions to determine the software composition of the target source code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SCA searches both open source code archives and Internet-based community-driven platform archives, then the coverage and credibility of vulnerability detection is improved, but the computing power and memory requirements increase significantly

Engineering Contradiction:

Improvecredibility of vulnerability detectionVSAvoidcomputing power and memory requirements

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent divides the SCA process into two distinct exploration phases: first exploring open source code archives, then exploring Internet-based community-driven platforms. This segmentation allows the system to handle different types of code repositories with appropriate strategies for each, reducing the overall computational burden while maintaining comprehensive coverage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary exploration of open source code archives before exploring community-driven platforms. By first identifying code from open source archives and collecting key information, the system can then focus its resources on verifying and supplementing this information from community platforms, rather than treating all sources equally from the start.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If SCA includes Internet-based community-driven platforms in the analysis, then the accuracy of source code origin identification is improved, but the complexity of the analysis process increases

Engineering Contradiction:

Improveaccuracy of source code origin identificationVSAvoidcomplexity of analysis process

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent uses key information (such as code snippets, file paths, or identifying features) as an intermediary between the two exploration processes. This intermediary allows the system to link findings from community-driven platforms back to their potential open source origins without requiring direct comparison of entire codebases, simplifying the matching process.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements a feedback mechanism where findings from the second exploration (community platforms) are mapped back to results from the first exploration (open source archives). This feedback loop allows the system to verify origins, resolve ambiguities, and improve identification accuracy by cross-referencing information from both sources.

Inventive Principle:

Principle #23Feedback

3Reliability

If SCA performs comprehensive mapping and filtering of source code snippets from multiple sources, then the license compliance assessment is improved, but the time required for analysis increases

Engineering Contradiction:

Improvelicense compliance assessmentVSAvoidanalysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts and focuses on key information from source code files and snippets, such as identifying code segments, file metadata, and licensing information. By extracting only the essential elements needed for license compliance assessment rather than analyzing entire codebases, the system reduces analysis time while maintaining assessment reliability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent discards duplicate or redundant information during the mapping process, keeping only unique and relevant findings. When code snippets are found in both open source archives and community platforms, the system discards redundant entries and recovers only the essential licensing and origin information, reducing overall analysis time while preserving compliance assessment accuracy.

Inventive Principle:

Principle #34Discarding and recovering

Data Source

PatentUS12282766B2Software composition analysis on target source code

Publication Date: 2025.04.22 SNYK SWEDEN AB

AI summary

Embodiments perform software composition analysis of target source code. A first exploration process searches first software archives for first occurrences of the target source code among source code files, and for every found first occurrence of the target source code, collects a first set of information about matching source code files or snippets therein. A second exploration process searches second software archives (different from the first plurality of archives) for second occurrences of the target source code among source code snippets, and for every found second occurrence of the target source code, collects a second set of information about matching source code snippets. Each matching source code snippet among the matching source code snippets as collected in the second set of information is mapped to the matching source code files or snippets therein as collected in the first set of information. A software composition is determined based on the mapping.