# US 12,008,113 B2 · Content matching and vulnerability remediation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,113 B2 - Document ID: US12008113B2 - Status: Granted - Kind: B2 - Application number: 17/672,913 - Filed: 2022-02-16 - Published: 2022-08-25 - Granted: 2024-06-11 - Earliest claimed: 2021-02-22 - Applicants: Haihua Feng - Inventors: Haihua Feng - Web page: https://patentgrep.com/patent/US12008113B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 8/34: Graphical or visual programming - G06F 8/36: Software reuse - G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management - G06F 16/152: {using file content signatures, e.g. hash values} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06N 5/02: Knowledge representation; Symbolic representation - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract An example method matches content, such as files and file snippets, using one or more scalable knowledge bases. The example method includes the following operations: receiving input content through a user interface; generating a whole file signature representing an entirety of the input content, where the whole file signature is based on a hash of the input content; searching a first knowledge base for a file having a whole file signature that matches the generated whole file signature; processing the input content to identify a snippet of content in a second knowledge base based on signature vector corresponding to the input content; generating a report based on at least one of the file or the snippet of content; and displaying the report on a user interface. ## Claims ### Claim 1 One or more non-transitory machine-readable storage media storing instructions that are executable by one or more processing devices to perform operations comprising: receiving input content through a user interface; generating a whole file signature representing an entirety of the input content, the whole file signature being based on a hash of the input content; searching a first knowledge base for a file having a whole file signature that matches the generated whole file signature; processing the input content to identify a snippet of content in a second knowledge base based on a signature vector corresponding to the input content; generating a report based on at least one of the file or the snippet of content; and displaying the report on a user interface; wherein processing the input content comprises: generating the signature vector corresponding to the input content, the signature vector being based on a hash of at least part of the input content; and searching the second knowledge base for the snippet of content based on the signature vector; wherein the report shows a hash value corresponding to the file or the snippet of content, but not text from the file or the snippet of content; and wherein a hash value associated with the whole file signature is used for searching the first knowledge base or a hash value associated with the signature vector is used for searching the second knowledge base. ### Claim 2 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the report is user-navigable to details regarding the file identified and at least one of the snippet et identified or bug fix code. ### Claim 3 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the first knowledge base and the second knowledge base are part of a system comprised of multiple data stores that are ranked by tier, with a higher tier data store taking precedence in order of search over a lower tier data store; and wherein searching the first knowledge base comprises searching the multiple data stores based on tier and returning the file from the first knowledge base before searching of all of the multiple data stores has completed. ### Claim 4 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the file is associated with a score, the score being higher than scores of other files in the first knowledge base; wherein searching the first knowledge base comprises returning the file from the first knowledge base before searching of all files having lower scores than the file has been completed; and wherein the first knowledge base and the second knowledge base comprise information based on at least one of a public repository or a private repository. ### Claim 5 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the operations comprise: receiving user selection of the file or the snippet of content in the report; generating a signature for the user-selected file or the snippet of content; comparing the signature to at least one of the whole file signature or the signature vector; and providing an output result based on the comparing, the output result comprising details regarding where the input content is located in the file or the snippet of content. ### Claim 6 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein content of at least one of the first knowledge base or the second knowledge base is compressed; and wherein compression of the content of the first knowledge base or the second knowledge base is based on minimum and maximum elements, a sliding window, and a score associated with a file or a snippet of content. ### Claim 7 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein at least one of the whole file signature or the signature vector is indexed in a database based on a file score, the file score being based on metadata associated with a file or a snippet of content corresponding, respectively, to a file signature or a snippet signature that is part of the signature vector. ### Claim 8 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the report comprises a text viewer or editor configured to display the input content referenced to at least one of the file or the snippet of content. ### Claim 9 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein at least one of the file or the snippet of content displayed comprises a hyperlink to content in a knowledge base. ### Claim 10 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the report comprises a text viewer or editor configured to display a reference view based on the snippet of content, the reference view comprising a graphical indicator directed to content related to the snippet of content. ### Claim 11 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the second knowledge base comprises compressed content; wherein compression ratios associated with the second knowledge base are adjustable over time based on logged data; and wherein the logged data comprises prior matchings of input content to at least one of a file or a snippet of content. ### Claim 12 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the second knowledge base comprises signature vectors including the signature vector; and wherein the signature vectors are organized in the second knowledge base by tiers that are adjustable based on scores associated with snippets of content that correspond to the signature vectors. ### Claim 13 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein at least one of the file or the input content has been transformed prior to searching the first knowledge base; and wherein transforming comprises at least one of removing trivial lines, removing code comments, removing characters that are not alphabetic or numerical, or anonymizing variable, function, class, method, and file names. ### Claim 14 (depends on 1) The one or more non-transitory machine-readable storage media of claim 1, wherein the second knowledge base stores signature vectors that are independent of of locations of snippets of content represented by the signature vectors. ### Claim 15 A method performed by one or more processing devices, the method comprising: receiving input content through a user interface; generating a whole file signature representing an entirety of the input content, the whole file signature being based on a hash of the input content; searching a first knowledge base for a file having a whole file signature that matches the generated whole file signature; processing the input content to identify a snippet of content in a second knowledge base based on a signature vector corresponding to the input content; generating a report based on at least one of the file or the snippet of content; and displaying the report on a user interface; wherein processing the input content comprises: generating the signature vector corresponding to the input content, the signature vector being based on a hash of at least part of the input content; and searching the second knowledge base for the snippet of content based on the signature vector; wherein the report shows a hash value corresponding to the file or the snippet of content, but not text from the file or the snippet of content; and wherein a hash value associated with the whole file signature is used for searching the first knowledge base or a hash value associated with the signature vector is used for searching the second knowledge base. ### Claim 16 (depends on 15) The method of claim 15, wherein the report is user-navigable to details regarding the file identified and at least one of the snippet identified or bug fix code. ### Claim 17 (depends on 15) The method of claim 15, wherein the first knowledge base and the second knowledge base are part of a system comprised of multiple data stores that are ranked by tier, with a higher tier data store taking precedence in order of search over a lower tier data store; and wherein searching the first knowledge base comprises searching the multiple data stores based on tier and returning the file from the first knowledge base before searching of all of the multiple data stores has completed. ### Claim 18 (depends on 15) The method of claim 15, wherein the file is associated with a score, the score being higher than scores of other files in the first knowledge base; wherein searching the first knowledge base comprises returning the file from the first knowledge base before searching of all files having lower scores than the file has been completed; and wherein the first knowledge base and the second knowledge base comprise information based on at least one of a public repository or a private repository. ### Claim 19 (depends on 15) The method of claim 15, wherein the operations comprise: receiving user selection of the file or the snippet of content in the report; generating a signature for the user-selected file or the snippet of content; comparing the signature to at least one of the whole file signature or the signature vector; and providing an output result based on the comparing, the output result comprising details regarding where the input content is located in the file or the snippet of content. ### Claim 20 (depends on 15) The method of claim 15, wherein the report comprises a text viewer or editor configured to display the input content referenced to at least one of the file or the snippet of content.