AUTOMATED COMPREHENSIVE SECURITY SCANNING SYSTEM FOR LARGE-SCALE DISTRIBUTED CODE REPOSITORIES

Number: 20250371151
Published: 2025-12-04
Filed: 2024-09-05
Assignee: DISNEY ENTERPRISES, INC.
Inventors: PATEL; Karishma Mahesh et al.
CPC: G06F21/563; G06F16/27; G06F21/577
Verdict: Set aside code-repository security scanning, IT/cybersecurity
Source: Google Patents · FreePatentsOnline

Abstract

The present invention sets forth a technique for performing automated software security scanning. The method includes copying a plurality of codebase branches included in a code repository into a clone database, based on one or more scripts included in a script database. The method also includes simultaneously executing one or more scanning operations on each of the plurality of codebase branches via a plurality of processing threads and generating one or more scan results based on the one or more scanning operations executed on the plurality of codebase branches.

Background

BACKGROUND Field of the Various Embodiments

Embodiments of the present disclosure relate generally to computer security and, more specifically, to automated techniques for performing automated software security scanning on large-scale distributed code repositories. DESCRIPTION OF THE RELATED ART

Software security scanning is a critical task for many organizations and is necessary to assess security vulnerabilities in a software codebase. Software security scanning may also identify open-source software licensing issues in a codebase, as well as detect organizational secrets or other sensitive information that may be improperly stored in a software codebase. An organization may maintain multiple software codebases stored within one or more source code management (SCM) systems or code repositories. Further, each codebase within an SCM may include multiple branches of software code, such as a development branch or a production branch.

Existing techniques for performing automated software security scanning are typically limited to scanning software codebases individually, or in small batches of tens or dozens of software codebases. Consequently, these techniques do not scale to very large collections of software codebases and are not computationally performant to automatically scan tens or hundreds of thousands of software codebases in an acceptable period of time. For example, scanning tens of thousands of software codebases individually or in small batches

Claims

1. A computer-implemented method for performing automated software security scanning, the method comprising: copying, via execution of one or more scripts included in a script database, a plurality of codebase branches included in a code repository into a clone database; launching a plurality of container tasks for simultaneously executing one or more scanning operations on codebase branches included in the plurality of codebase branches; and generating one or more scan results based on the one or more scanning operations executed on the plurality of codebase branches. || 11. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of: copying, via execution of one or more scripts included in a script database, a plurality of codebase branches included in a code repository into a clone database; launching a plurality of container tasks for simultaneously executing one or more scanning operations on codebase branches included in the plurality of codebase branches; and generating one or more scan results based on the one or more scanning operations executed on the plurality of codebase branches. || 18. A system comprising: one or more memories for storing instructions; and one or more processors for executing the instructions to: copy, via execution of one or more scripts included in a script database, a plurality of codebase branches included in a code repository into a clone database; launch a plurality of container tasks for simultaneously executing one or more scanning operations on codebase branches included in the plurality of codebase branches; and generating one or more scan results based on the one or more scanning operations executed on the plurality of codebase branches.