Granted Patent B2

US 12,321,464 · App. 18/917,410 · Granted Jun 3, 2025

Inventors: Eshel Yaron (Amsterdam, NL); Tomer Schwartz (Tel Aviv, IL); Pavel Resnianski (Tel Aviv, IL)

Assignee: Dazz, Inc.

G06F21/577G06F2221/033

Abstract

Claims (62)

1. A method for software containers attribution, comprising:

de-compiling a configuration file of a first container image of a software container, wherein the first container image is among a plurality of container images, wherein the de-compiled configuration file includes a plurality of commands;

identifying at least one candidate build file in the de-compiled configuration file, wherein each candidate build file contains a plurality of commands executed to create a respective container image among the plurality of container images;

determining if at least one matching condition is satisfied between each of the at least one candidate build file and the de-compiled configuration file based on the plurality of commands of the de-compiled configuration file and the plurality of commands of each of the at least one candidate build file;

associating the configuration file with each candidate build file satisfying the at least one matching condition; and

updating an inventory with the associated configuration file and the respective candidate build file, wherein such association provides a direct mapping between the container image and each build file that formed the container image.

2. The method of claim 1 , further comprising:

retrieving, from a software container repository, any of the configuration file and the container image; and

retrieving build files from a code repository.

3. The method of claim 2 , further comprising:

determining attribution for each container image stored in the software container repository.

4. The method of claim 1 , wherein identifying the at least one candidate build file further comprises:

searching for matching commands in both the de-compiled configuration and build files, wherein a build file with at least one matching command is a candidate build file.

5. The method of claim 1 , wherein determining if the at least one matching condition is satisfied, further comprises:

determining if there is only one candidate build file; and

associating the only one candidate build file with the de-compiled configuration file.

6. The method of claim 1 , wherein determining if the at least one matching condition is satisfied further comprises:

matching each of the candidate build files to the de-compiled configuration file based on a matching condition, wherein the matching condition includes any one of: similarity; a creation time; a number of commands; and a hierarchical matching.

7. The method of claim 6 , wherein the similarity matching condition is satisfied when all candidate build files are the same file and match the de-compiled configuration file.

8. The method of claim 6 , wherein the creation time matching condition is satisfied when the creation time of a candidate build time is earlier than a creation time of a container image corresponding to the de-compiled configuration file.

9. The method of claim 6 , wherein the number of commands matching condition is satisfied when the number of commands, excluding FROM commands, in the de-compiled configuration file is the same as the number of commands in a candidate build file.

10. The method of claim 6 , further comprising:

performing the hierarchical matching when the container image is formed from multiple build files.

11. The method of claim 10 , wherein the hierarchical matching is satisfied when a dependency tree representing a relationship between the candidate build files and the container image matches commands, excluding FROM commands, listed in the de-compiled configuration file.

12. The method of claim 1 , wherein updating the inventory further comprises:

associating each container layer in the container image with a respective code line in the build file; and

listing any vulnerability reported on at least one of: the container image and its image layers.

13. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for software containers attribution, the process comprising:

de-compiling a configuration file of a first container image of a software container, wherein the first container image is among a plurality of container images, wherein the de-compiled configuration file includes a plurality of commands;

identifying at least one candidate build file in the de-compiled configuration file, wherein each candidate build file contains a plurality of commands executed to create a respective container image among the plurality of container images;

determining if at least one matching condition is satisfied between each of the at least one candidate build file and the de-compiled configuration file based on the plurality of commands of the de-compiled configuration file and the plurality of commands of each of the at least one candidate build file;

associating the configuration file with each candidate build file satisfying the at least one matching condition; and

updating an inventory with the associated configuration file and the respective candidate build file, wherein such association provides a direct mapping between the container image and each build file that formed the container image.

14. A system for remediating software containers attribution, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

de-compile a configuration file of a first container image of a software container, wherein the first container image is among a plurality of container images, wherein the de-compiled configuration file includes a plurality of commands;

identify at least one candidate build file in the de-compiled configuration file, wherein each candidate build file contains a plurality of commands executed to create a respective container image among the plurality of container images;

determine if at least one matching condition is satisfied between each of the at least one candidate build file and the de-compiled configuration file based on the plurality of commands of the de-compiled configuration file and the plurality of commands of each of the at least one candidate build file;

associate the configuration file with each candidate build file satisfying the at least one matching condition; and

update an inventory with the associated configuration file and the respective candidate build file, wherein such association provides a direct mapping between the container image and each build file that formed the container image.

15. The system of claim 14 , wherein the system is further configured to:

retrieve, from a software container repository, any of the configuration file and the container image; and

retrieve build files from a code repository.

16. The system of claim 15 , wherein the system is further configured to:

determine attribution for each container image stored in the software container repository.

17. The system of claim 14 , wherein the system is further configured to:

search for matching commands in both the de-compiled configuration and build files, wherein a build file with at least one matching command is a candidate build file.

18. The system of claim 14 , wherein the system is further configured to:

determine if there is only one candidate build file; and

associate the only one candidate build file with the de-compiled configuration file.

19. The system of claim 14 , wherein the system is further configured to:

match each of the candidate build files to the de-compiled configuration file based on a matching condition, wherein the matching condition includes any one of: similarity; a creation time; a number of commands; and a hierarchical matching.

20. The system of claim 19 , wherein the similarity matching condition is satisfied when all candidate build files are the same file and match the de-compiled configuration file.

21. The system of claim 19 , wherein the creation time matching condition is satisfied when the creation time of a candidate build time is earlier than a creation time of a container image corresponding to the de-compiled configuration file.

22. The system of claim 19 , wherein the number of commands matching condition is satisfied when the number of commands, excluding FROM commands, in the de-compiled configuration file is the same as the number of commands in a candidate build file.

23. The system of claim 19 , wherein the system is further configured to:

perform the hierarchical matching when the container image is formed from multiple build files.

24. The system of claim 23 , wherein the hierarchical matching is satisfied when a dependency tree representing a relationship between the candidate build files and the container image matches commands, excluding FROM commands, listed in the de-compiled configuration file.

25. The system of claim 14 , wherein the system is further configured to:

associate each container layer in the container image with a respective code line in the build file; and

list any vulnerability reported on at least one of: the container image and its image layers.

Continuity (2)

References Cited (48)