Method and system for matching unknown software component to known software component

• US 9,330,095 B2
• Filed: 05/07/2014
• Issued: 05/03/2016
• Est. Priority Date: 05/21/2012
• Status: Active Grant

• Current Assignee: Sonatype
• Original Assignee: Sonatype
• Inventors: Fedorenko, Igor, Tatavu, Vlad, Whitehouse, Jamie, Fox, Brian Edward
• Primary Examiner(s): Fleurantin, Jean B
• Application Number:
  US14/271,648
• Publication Number:
  US 20140244679A1
• Time in Patent Office: 727 Days
• Field of Search: 707/758, 707/899, 717/100, 717/101, 717/121, 717/122
• US Class Current: 1/1
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: G06F 16/907 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

A computer system or method identifies components. A component fingerprint storage is configured to memorize known fingerprints of known components. The term “component” used herein is defined to be a specific version of pre-existing executable software, or a reusable pre-existing self-contained software code building block which is not a complete stand-alone finished product ready for use and which is binary or source code. A fingerprint is generated for a normalized unknown component and fingerprints are generated for all normalized components included in the unknown component. It is determined whether any of the fingerprints generated for the normalized unknown component and for the normalized components included in the unknown component match any of the known fingerprints of known components.

Claims

1. A computer system that identifies components, comprising:

a component fingerprint storage configured to memorize known fingerprints of known components, wherein a component is a specific version of pre-existing executable code or a reusable pre-existing self-contained code building block which is not a complete alone finished product ready for use and which is binary or source code; and

a processor cooperatively operable with the component fingerprint storage, and configured to facilitate, based on an unknown component;

determining internal components included within the unknown component;

generating fingerprints for the unknown component and finger prints for all the internal components determined to be included in the unknown component;

determining whether any of the fingerprints generated for the unknown component and for the components included in the unknown component match any of the known fingerprints of known components; and

determining whether the unknown component matches any of the known components based on matching of the known fingerprints of the components included in the unknown component.

2. The computer system of claim 1, further comprising generating the known fingerprints of known components and then storing the known fingerprints in the component fingerprint storage.

3. The computer system of claim 1, wherein the fingerprints are hash values.

4. The computer system of claim 1, further comprising normalizing the unknown component and all of the components included in the unknown component, before generating the fingerprints for the unknown component and the components included in the unknown component, wherein normalizing an individual component accounts for compiler and/or build noise.

5. The computer system of claim 4, further comprising

for each of the components in the unknown component, before normalizing the component, determining a type of the component and determining a normalization process associated with the type of the component,

wherein the component is normalized according to the normalization process determined to be associated with the type of the component.

6. The computer system of claim 1, further comprising

indicating a match between the unknown component and the known component which was determined based on matching of the components included internal to the unknown component.

7. A computer-implemented method for identifying a component, comprising:

memorizing, in a component fingerprint storage, known fingerprints of known components, wherein a component is a specific version of pre-existing executable code or a reusable pre-existing self-contained code building block which is not a complete alone finished product ready for use and which is binary or source code; and

based on an unknown component;

determining, in a processor, internal components included within the unknown component;

generating, in the processor, fingerprints for the unknown component and fingerprints for all the internal components determined to be included in the unknown component;

determining, in the processor, whether any of the fingerprints generated for the unknown component and for the components included in the unknown component match any of the known fingerprints of known components of the component fingerprint storage; and

determining, in the processor, whether the unknown component matches any of the known components based on matching of the known fingerprints of the components included in the unknown component.

8. The method of claim 7, further comprising generating the known fingerprints of known components and then storing the known fingerprints in the component fingerprint storage.

9. The method of claim 7, wherein the fingerprints are hash values.

10. The method of claim 7, further comprising normalizing the unknown component and all of the components included in the unknown component, before generating the fingerprints for the unknown component and the components included in the unknown component, wherein normalizing an individual component accounts for compiler and/or build noise.

11. The method of claim 10, further comprising

for each of the components in the unknown component, before normalizing the component, determining a type of the component and determining a normalization process associated with the type of the component,

wherein the component is normalized according to the normalization process determined to be associated with the type of the component.

12. The method of claim 7, further comprising

indicating a match between the unknown component and the known component which was determined based on matching of the components included internal to the unknown component.

13. A non-transitory computer-readable storage medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for identifying a component, the instructions for implementing:

memorizing, in a component fingerprint storage, known fingerprints of known components, wherein a component is a specific version of pre-excitable code, or a reusable pre-existing self-contained code building block which is not a complete stand-alone finished product ready for use and which is binary or source code;

based on an unknown component;

determining, in a processor, internal, components included within the unknown component;

generating, in the processor, fingerprints for the unknown component and fingerprints for all the internal components determined to be included in the unknown component;

determining, in the processor, whether any of the fingerprints generated for the components included in the unknown component match any of the known fingerprints of known components or the component fingerprint storage; and

determining, in the processor, whether the unknown component matches any of the known components based on matching of the known fingerprints of the components included in the unknown component.

14. The non-transitory computer-readable storage medium of claim 13, further comprising generating the known fingerprints of known components and then storing the known fingerprints in the component fingerprint storage.

15. The non-transitory computer-readable storage medium of claim 13, wherein the fingerprints are hash values.

16. The non-transitory computer-readable storage medium of claim 13, further comprising normalizing the unknown component and all of the components included in the unknown component, before generating the fingerprints for the unknown component and the components included in the unknown component, wherein normalizing an individual component accounts for compiler and/or build noise.

17. The non-transitory computer-readable storage medium of claim 13, further comprising

for each of the components in the unknown component, before normalizing the component, determining a type of the component and determining a normalization process associated with the type of the component,

wherein the component is normalized according to the normalization process determined to be associated with the type of the component.

18. The non-transitory computer-readable storage medium of claim 13, further comprising

indicating a match between the unknown component and the known component which was determined based on matching of the components included internal to the unknown component.

19. A computer-implemented method for generating a universal fingerprint for a Java component, comprising, in this order:

responsive to an unknown component which is a Java component,

for the Java component, in a processor, normalizing the Java component according to a Java normalization process to provide a normalized Java component; and

generating, in the processor, the fingerprint for the normalized Java component, as a universal fingerprint, wherein

the fingerprint is a hash value, and

the Java normalization process performs the following on the Java component;

setting class version to 0,

resetting synthetic class access flags,

setting outer class name to null,

setting constant pool and inner class list in alphabetical order,

resetting final access flag of Java enumerations #values method,

removing all synthetic member fields and Java methods, and

removing all package names.