Software bill-of-materials via file activity tracking

1 . A system of determining a software runtime bill-of-materials (RBOM) of an operating environment, the system comprising a processing circuitry configured to:

a. identify a first software process executing in the operating environment;

b. determine, from data or metadata of a file associated with the first software process, a software framework of the first software process; and

c. for each of one or more runnable files located in the operating environment and associated with the identified software framework:

i. determine, from metadata associated with the runnable file, a respective time of most recent access of the runnable file, and

ii. responsive to the respective time of most recent access of the runnable file being later than a start time of the first software process:

adding a respective file path of the runnable file to the RBOM.

2 . The system of claim 1 , wherein the processing circuitry is further configured to perform the determination of the software framework based on at least one of:

i. a path of a file run by the first software process; and

ii. metadata of the file run by the first software process.

3 . The system of claim 1 , the processing circuitry being further configured to:

d. repeat a.-c. for one or more additional processes executing in the operating environment.

4 . The system of claim 3 , wherein the processing circuitry is further configured to:

e. responsive to an event, repeat a.-d. for one or more additional iterations.

5 . The system of claim 4 , wherein the event is an expiration of a delay.

6 . A processing circuitry-based method of determining a software runtime bill-of-materials (RBOM) of an operating environment, the method comprising:

a. identifying a first software process executing in the operating environment;

b. determining, from data or metadata of a file associated with the first software process, a software framework of the first software process; and

c. for each of one or more runnable files located in the operating environment and associated with the identified software framework:

i. determining, from metadata associated with the runnable file, a respective time of most recent access of the runnable file, and

ii. responsive to the respective time of most recent access of the runnable file being later than a start time of the first software process:

adding a respective file path of the runnable file to the RBOM.

7 . A computer program product comprising a computer readable non-transitory storage medium containing program instructions, which program instructions when read by a processor, cause the processing circuitry to perform of determining a software runtime bill-of-materials (RBOM) of an operating environment, the method comprising:

a. identifying a first software process executing in the operating environment;

b. determining, from data or metadata of a file associated with the first software process, a software framework of the first software process; and

c. for each of one or more runnable files located in the operating environment and associated with the identified software framework:

i. determining, from metadata associated with the runnable file, a respective time of most recent access of the runnable file, and

ii. responsive to the respective time of most recent access of the runnable file being later than a start time of the first software process:

adding a respective file path of the runnable file to the RBOM.