Software Genome Knowledge Graph for Multi-Dimensional Risk Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software intelligence services are limited in assessing a variety of risks related to software, primarily focusing on malware detection and lack flexibility to provide comprehensive risk management for organizations, failing to address issues like software bugs, vulnerabilities, plagiarism, and malicious code effectively.
Innovation Solution
A method and system for providing software intelligence as-a-service that decomposes software into functional blocks to create a software genome, represented in a knowledge graph, allowing for the identification of issues such as bugs, plagiarism, and other risks by analyzing granularities like function, basic block, or file levels, and leveraging threat intelligence to refine risk assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software intelligence services focus only on malware detection and basic scanning, then the service complexity is low and easy to implement, but the comprehensive risk management capability is insufficient and cannot detect bugs, vulnerabilities, plagiarism, and malicious code effectively
Solution Approach 1:
The patent segments software analysis into multiple specialized modules: malware detection module, vulnerability scanning module, plagiarism detection module, and code quality analysis module. Each module focuses on a specific aspect of software risk, allowing the system to provide comprehensive risk management through coordinated operation of specialized components rather than a single complex monolithic system
Solution Approach 2:
The patent creates a universal software intelligence platform that performs multiple functions through a shared architecture. The system can detect malware, scan for vulnerabilities, identify plagiarism, and analyze code quality using common infrastructure including data collection modules, analysis engines, and reporting systems, thereby achieving comprehensive risk management without proportionally increasing overall system complexity
2Measurement precision
If software analysis is performed at high level without detailed decomposition, then the analysis speed is fast and resource consumption is low, but the measurement precision and ability to identify specific issues is insufficient
Solution Approach 1:
The patent implements dynamic analysis depth adjustment where the system can adaptively choose the level of decomposition based on the analysis target and requirements. For routine scans, high-level analysis provides quick results, while for suspected issues or detailed audits, the system automatically increases decomposition depth to examine individual code statements, thereby balancing precision requirements with time constraints
Solution Approach 2:
The patent segments the software into hierarchical levels: project level, module level, function level, and statement level. This segmentation allows the system to perform efficient high-level scanning across the entire codebase and then drill down to detailed statement-level analysis only for suspicious or critical areas, maintaining both speed and precision
3Loss of information
If detailed software decomposition into functional blocks is performed, then the software genome representation provides comprehensive insights into software health and security, but the device complexity and processing requirements increase significantly
Solution Approach 1:
The patent creates an abstracted copy of the software structure called a 'software genome' that captures essential characteristics without requiring the full complexity of the original codebase. This genome representation includes simplified metadata about code structure, dependencies, and characteristics, allowing comprehensive analysis while reducing processing complexity by working with the abstracted model rather than the complete detailed code
4Adaptability or versatility
If multiple analysis dimensions and granularities are examined, then the comprehensive risk assessment capability is improved, but the loss of time and computational resources increases
Solution Approach 1:
The patent implements partial analysis where the system performs comprehensive multi-dimensional analysis only when necessary, and uses simplified single-dimension scanning for routine checks. The system can selectively apply detailed code statement analysis, function-level analysis, or module-level analysis based on risk indicators and user requirements, thereby maintaining comprehensiveness for critical assessments while improving efficiency for routine monitoring
Data Source
AI summary
A method, system and apparatus for software intelligence as-a-service, including decomposing software into functional blocks to provide a software genome, building a representation of the software genome in a knowledge graph linking granularities of the functional blocks, and identifying issues with a target software based on the knowledge graph.