| CPC G06F 21/577 (2013.01) [G06F 2221/033 (2013.01)] | 20 Claims |

|
1. A computer-implemented method comprising:
receiving a software package comprising code;
identifying functions within the software package that implement or use cryptographic primitives by;
generating an intermediate representation for each function;
generating, for each intermediate representation, an embedding;
extracting, for each function, features from both of the corresponding intermediate representation and the embedding; and
inputting, for each function, the corresponding extracted features into a machine learning model trained and configured to identify functions or components comprising cryptographic primitives;
determining a set of calls associated with each of the identified functions;
performing, based on the determined set of calls, a call site analysis to determine cryptographic algorithm parameters;
generating, based on the set of calls, the call site analysis, and a call graph characterizing relationships amongst different functions in the code, a cryptography bill of materials (CBOM) detailing cryptographic primitives within the software package; and
providing the CBOM to a consuming application or process over a network to a remote computing system.
|