System and method for performing software due diligence using a binary scan engine and parallel pattern matching

A system having a processor for performing software due diligence review, comprising:

• a build system configured to receive software subject to due diligence review, wherein the received software includes at least one binary object;
• a binary scan engine configured to generate a component dependency tree for the at least one binary object, wherein the component dependency tree includes one or more packages associated with binary object;
• an unpacking engine configured to expose plain text information for at least one source file associated with the one or more packages;
• and
• a software diligence engine configured to:
• search the plain text information for the at least one source file to identify one or more keywords relevant to the due diligence review;
• identify one or more normal keywords that indicate language potentially relevant to the due diligence review;
• identify one or more negative keywords that indicate language irrelevant to the due diligence review, wherein a threshold proximity is associated with each of the respective negative keywords;
• negate at least one of the normal keywords if the at least one normal keyword appears within the threshold proximity associated with one or more of the negative keywords;
• identify a plurality of weak normal keywords that indicate language potentially relevant to the due diligence review, wherein a threshold value is associated with each of the respective weak normal keywords;
• increment a normal counter according to the threshold values associated with each of the respective weak normal keywords;
• and
• trigger a keyword match for the plurality of weak normal keywords if the normal counter exceeds a first threshold value;
• match the identified keywords against a plurality of text patterns that contain excerpts of language relevant to the due diligence review;
• and
• construct a report providing information relating to the due diligence review, wherein the report indicates whether the software has potential compliance problems regarding one or more of software licenses, export regulations, or internal security policies.