# US 9,436,463 B2 · System and method for checking open source usage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,463 B2 - Document ID: US9436463B2 - Status: Granted - Kind: B2 - Application number: 14/594,384 - Filed: 2015-01-12 - Published: 2016-07-14 - Granted: 2016-09-06 - Earliest claimed: 2015-01-12 - Assignees: Whitesource Ltd. - Applicants: WhiteSource Ltd. - Inventors: Rami Sass; Ron Rymon; Tom Shapira - Web page: https://patentgrep.com/patent/US9436463B2 ## CPC - G06F 8/751: {Code clone detection} - G06F 8/75: Structural analysis for program understanding - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level} - G06F 21/563: {by source code analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, system and computer program product, the method comprising: receiving a characteristic of a source code entity to be checked; comparing the characteristic of the source code entity to be checked to characteristics stored in a repository; and subject to determining with at least a first probability that the characteristic of the source code entity to be checked is found in the repository, providing an indication of an open source library associated with the characteristic, wherein the source code entity to be checked is not received with the characteristic. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked; comparing the first characteristic to characteristics stored in a repository representing an open source library; comparing the second characteristic to the characteristics stored in the repository; based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library; based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library; determining, due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and providing an indication of the open source library, wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining a characteristic of an open source code entity associated with an open source project; and storing the characteristic and an identifier of the open source code entity in the repository. ### Claim 3 (depends on 2) The method of claim 2 wherein the identifier comprises a name of the open source project. ### Claim 4 (depends on 2) The method of claim 2 wherein the identifier comprises an item selected from the group consisting of: a license associated with the open source project, a vulnerability, a bug, a quality issue, a trend report, a replacement, and information related to other users that use the open source project. ### Claim 5 (depends on 1) The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a hash value assigned to the first source code or the second source code entity, respectively. ### Claim 6 (depends on 5) The method of claim 5 wherein the hash value is obtained by performing SHA-1 hash function upon the first source code entity or the second source code entity, respectively. ### Claim 7 (depends on 1) The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively. ### Claim 8 (depends on 1) The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a value computed based on a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively. ### Claim 9 (depends on 1) The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a file. ### Claim 10 (depends on 1) The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a portion of a file. ### Claim 11 (depends on 1) The method of claim 1 wherein the first source code entity or the second source code entity to be checked comprises two portions of a file. ### Claim 12 (depends on 1) The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a predetermined number of code lines extracted from a file. ### Claim 13 (depends on 1) The method of claim 1 further comprising determining the characteristic of the first source code entity or the second source code entity to be checked. ### Claim 14 (depends on 13) The method of claim 13 further comprising removing non-functional parts of the first source code entity or the second source code entity prior to determining the characteristic. ### Claim 15 A system for determining open source usage, comprising: a processor; a communication component for receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked; a repository comprising a multiplicity of source code entity characteristics and an identifier of an open source library associated with each source code entity characteristic; a comparison component for: comparing the first characteristic to characteristics stored in a repository representing an open source library; comparing the second characteristic to the characteristics stored in the repository; based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library; based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library; and determining due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and a user interface module or communication module for providing the identifier of the open source library, wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic. ### Claim 16 (depends on 15) The system of claim 15, further comprising a characteristic determination component for determining the characteristic of the first source code entity or the second source code entity. ### Claim 17 (depends on 15) The system of claim 15 wherein the characteristic of the first source code entity or the second source code entity to be checked is a hash value assigned to the first source code entity or the second source code entity, respectively. ### Claim 18 (depends on 15) The system of claim 15 wherein the characteristic of the first source code entity or the second source code entity to be checked is a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively. ### Claim 19 A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising: receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked; comparing the first characteristic to characteristics stored in a repository representing an open source library; comparing the second characteristic to the characteristics stored in the repository; and based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library; based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library; determining due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and providing an indication of the open source library, wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic. ### Claim 20 (depends on 1) The method of claim 1 wherein an indication of the open source library being associated with the first characteristic is provided subject to the first probability exceeding a predetermined threshold. ### Claim 21 (depends on 15) The system of claim 15 wherein an indication of the open source library associated with the first characteristic is provided subject to the first probability exceeding a predetermined threshold.