Binary software composition analysis
A computer includes a memory and a processor programmed to execute instructions stored in the memory. The instructions include filtering dependency code from a binary file to separate the dependency code from custom code in the binary file. The instructions further include evaluating the custom code in the binary file for a security risk.
1. A computer comprising:
a memory; and
a processor programmed to execute instructions stored in the memory, the instructions including:
identifying a first version-specific fingerprint associated with a first version of a dependency code component;
searching, within dependency code of a binary file for the first version of the dependency code component based on the first version-specific fingerprint, wherein the dependency code of the binary file contains a second version of the dependency code component, wherein a second version-specific fingerprint associated with the second version of the dependency code component differs from the first version-specific fingerprint;
filtering cleared dependency code from the dependency code of the binary file to separate the cleared dependency code from custom code and altered dependency code in the dependency code of the binary file, wherein the cleared dependency code is code that has already passed a security evaluation, wherein the altered dependency code includes the second version of the dependency code component; and
evaluating the custom code and the altered dependency code in the dependency code of the binary file for a security risk.
2. The computer of claim 1 , wherein the instructions include receiving a code repository representing at least one instance of dependency code.
3. The computer of claim 2 , wherein the instructions include indexing the code repository.
4. The computer of claim 2 , wherein the instructions include developing a version-specific fingerprint for each instance of dependency code in the code repository.
5. The computer of claim 4 , wherein each version-specific fingerprint developed is a function of one of the instances of dependency code in the code repository.
6. The computer of claim 1 , wherein filtering the cleared dependency code includes removing the cleared dependency code from the binary file.
7. The computer of claim 1 , wherein the instructions include receiving the binary file.
8. The computer of claim 1 , wherein the instructions include generating statistics representing an amount of dependency code and an amount of custom code in the binary file.
9. The computer of claim 1 , wherein the instructions include generating a risk assessment file as a result of performing the security evaluation of the custom code and the altered dependency code.
10. A method implemented by a processor and memory, the method comprising:
receiving a binary file;
identifying a first version-specific fingerprint associated with a first version of a dependency code component;
searching, within dependency code of the binary file, for the first version of the dependency code component based on the first version-specific fingerprint, wherein the binary file contains a second version of the dependency code component, wherein a second version-specific fingerprint associated with the second version of the dependency code component differs from the first version-specific fingerprint;
filtering cleared dependency code from the dependency code of the binary file to separate the cleared dependency code from custom code and altered dependency code in the dependency code of the binary file, wherein the cleared dependency code is code that has already passed a security evaluation, wherein the altered dependency code includes the second version of the dependency code component; and
evaluating, by the processor, the custom code and the altered dependency code in the dependency code of the binary file for a security risk.
11. The method of claim 10 , further comprising receiving a code repository representing at least one instance of dependency code.
12. The method of claim 11 , further comprising indexing the code repository.
13. The method of claim 11 , further comprising developing a version-specific fingerprint for each instance of dependency code in the code repository, wherein each version-specific fingerprint developed is a function of one of the instances of dependency code in the code repository.
14. The method of claim 10 , wherein filtering the cleared dependency code includes removing the cleared dependency code from the binary file.
15. The method of claim 10 , further comprising generating statistics representing an amount of dependency code and an amount of custom code in the binary file.
16. The method of claim 10 , further comprising generating a risk assessment file as a result of performing the security evaluation of the custom code and the altered dependency code.