US 12,406,015 B2
Correlating open source component matching results using different scanning techniques
Douglas Albert Brown, Danvers, MA (US); Damon Alexander Weinstein, Arlington, MA (US); and Jagat Prakashchandra Parekh, Andover, MA (US)
Assigned to Black Duck Software, Inc., Burlington, MA (US)
Filed by Black Duck Software, Inc., Burlington, MA (US)
Filed on Feb. 8, 2022, as Appl. No. 17/667,473.
Prior Publication US 2023/0252100 A1, Aug. 10, 2023
Int. Cl. G06F 16/9538 (2019.01); G06F 8/71 (2018.01); G06F 16/951 (2019.01); G06F 16/954 (2019.01)
CPC G06F 16/9538 (2019.01) [G06F 8/71 (2013.01); G06F 16/951 (2019.01); G06F 16/954 (2019.01)] 17 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, by a processing device, a request to analyze a file hierarchy comprising a plurality of components;
sending, by the processing device, respective commands to a plurality of matching services;
receiving, by the processing device, respective individual results from the plurality of matching services, each of the respective individual results indicating a respective subset of the plurality of components, wherein each of the plurality of matching services is to identify the respective subset of the plurality of components using a different respective scanning technique of a plurality of scanning techniques, the plurality of scanning techniques comprising (i) signature matching where cryptographic hashes are created for the plurality of components and compared to cryptographic hashes of known components in the respective subset, (ii) package manager matching using metadata stored by a host system package manager and indicating the respective subset of the plurality of components, (iii) binary matching using compiled binaries of the plurality of components to extract identifying information of the respective subset, and (iv) snippet matching where cryptographic hashes are created for snippets of characters in source code of the plurality of components and compared to cryptographic hashes of known components in the respective subset; and
correlating, by the processing device, the respective individual results using external identifiers associated with the components of each respective subset to generate a unified set of results, wherein the external identifiers each represent a respective individual file and comprise a plurality of fields arranged in a defined hierarchical format to uniquely identify the individual file, wherein each field of the plurality of fields comprises a broader categorical descriptor of the individual file than a successive field in the external identifier.