Source Code Provenance Tracking via Segment Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining the origins of source code in software projects is challenging due to multiple versions, reuse, copying, renaming, and unexpected locations, making it difficult to attribute contributions and identify vulnerabilities.
Innovation Solution
A system using a searchable file provenance database generates file provenance signatures to track the origins of source code files, allowing for the identification of canonical sources, classification as library code, and proactive updates or vulnerability monitoring across multiple heterogeneous projects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If source code files are copied, renamed, or moved across multiple projects, then code reuse and productivity improve, but determining the true origin and provenance of the code becomes increasingly difficult
Solution Approach 1:
The patent segments source code into fixed-size windows (e.g., 40-character segments) and generates signatures for each segment. This segmentation allows the system to track provenance at a granular level, identifying the original source even when code is copied, renamed, or moved across projects. By breaking down files into manageable segments with unique signatures, the system can trace the origin of each segment independently.
Solution Approach 2:
The patent creates copies of source code segments in a centralized database, storing signatures and metadata for each segment. When code is copied across projects, the signature database already contains the original source information, enabling immediate provenance tracking without needing to follow the code through multiple copies and renames.
2Measurement precision
If a comprehensive database of all source code files across multiple projects is built, then provenance determination accuracy improves, but the complexity and resources required to maintain the database increase
Solution Approach 1:
The patent extracts only the essential provenance information (signatures, file paths, commit hashes, timestamps) from source code files and stores them in a simplified database structure. Instead of storing complete file copies or complex metadata, the system extracts and stores only the signature segments and their associated origin information, reducing database complexity while maintaining provenance accuracy.
Solution Approach 2:
The patent transforms source code into a different parameter representation by generating cryptographic signatures or hash values from code segments. This parameter transformation converts complex code content into compact, comparable signatures that are easier to store and search, reducing the resources needed to maintain the database while improving provenance determination efficiency.
3Reliability
If source code is analyzed without execution (static analysis), then safety and reliability improve by identifying vulnerabilities, but the ability to detect runtime behavior and actual usage patterns is lost
Solution Approach 1:
The patent performs preliminary static analysis by generating signatures and storing provenance information before the code is executed. This preliminary action captures the structural and textual characteristics of the code, enabling vulnerability identification and provenance tracking without needing to execute the code. The system prepares the provenance data in advance, so when code is copied or modified, the original source and potential vulnerabilities are already identified.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining the provenance of source code. One of the methods includes receiving a portion of a file occurring in a source code project. For each of a plurality of windows of characters in the portion of the file, a respective provenance signature is computed. An index that maps each provenance signature to occurrences of the provenance signature in one or more files of a plurality of projects is searched to identify one or more matching files that are each associated with at least one provenance signature computed for the portion of the file. Data identifying the one or more matching files is provided in response to receiving the portion of the file occurring in the source code project.