Vulnerability Scanning in Software Dependency Trees

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing solutions for detecting vulnerabilities in open-source software are inefficient when dealing with manifest files that contain many packages, each depending on numerous other packages, leading to complex dependency trees.

Innovation Solution

A system and method that includes a processor and memory to access and scan manifest files, extract software package data, generate dependency trees, and store them in a database, utilizing multi-threaded algorithms for efficient processing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If existing vulnerability detection solutions are used on manifest files with many packages and complex dependencies, then vulnerability detection can be performed, but the scanning efficiency becomes insufficient and processing time increases

Engineering Contradiction:

Improvevulnerability scanning efficiencyVSAvoidprocessing time for complex dependency trees

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The patent segments the complex vulnerability detection task by dividing it into multiple independent scanning threads. Each thread independently scans a portion of the dependency tree, allowing parallel processing of manifest files and their dependencies. This segmentation enables the system to handle large numbers of packages simultaneously, dramatically improving scanning efficiency while reducing total processing time.

Inventive Principle:

Principle #1Segmentation

2Reliability

If comprehensive scanning of all packages in the dependency tree is performed, then complete vulnerability detection is achieved, but the complexity of processing increases significantly

Engineering Contradiction:

Improvecompleteness of vulnerability detectionVSAvoidprocessing complexity for large dependency trees

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system segments the dependency tree into manageable portions that can be processed by separate scanning threads. Each thread handles a specific segment independently, reducing the complexity any single processing unit must manage while maintaining complete coverage of all packages for reliable vulnerability detection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a coordination mechanism that acts as an intermediary between multiple scanning threads and the central processing system. This intermediary manages thread synchronization, aggregates results from different segments, and coordinates the overall scanning process, thereby reducing processing complexity while ensuring comprehensive vulnerability detection across the entire dependency tree.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11893120B1Apparatus and method for efficient vulnerability detection in dependency trees

Publication Date: 2024.02.06 SOOS LLC

AI summary

An apparatus for scanning vulnerabilities, wherein the apparatus includes at least a processor and a memory communicatively connected to the at least a processor, the memory containing instructions configuring the at least a processor to access at least a manifest file, wherein the at least manifest file includes at least a direct dependency, scan the manifest file for a software package data, extract the software package data from the manifest file, generate at least a dependency tree as a function of the software package data, and store the dependency tree in a database. A method for scanning vulnerabilities is also disclosed.