Analysis Tools
SeonCA — Open Source Identification That Traces Source Code Down to Every Line
SeonCA precisely identifies, at the function level, the open source software (OSS) hidden within firmware and embedded source code.
It detects even copied and modified open source that package managers miss, and automatically generates a trustworthy SBOM.
SeonCA precisely identifies, at the function level, the open source software (OSS) hidden within firmware and embedded source code. It detects even copied and modified open source that package managers miss, and automatically generates a trustworthy SBOM.
Why You Need This
SBOM and Open Source Management — Are You Facing These Challenges?
Your customers and regulators require an SBOM, but do you know exactly which open source is included in your firmware?
It is difficult for people to manually trace the open source composition of an embedded codebase that has accumulated over many years.
Does open source that was copied directly into your source (vendoring), without a package manager, go undetected by your existing tools?
C/C++ embedded projects often copy entire libraries into the source, so dependency-file-based tools miss them.
Is it hard to verify whether the open source contains known vulnerabilities (CVEs) and whether your product is actually affected?
Even after finding a component, linking it to which vulnerabilities it is exposed to is yet another burden.
Product Introduction
SeonCA
SeonCA is an open source detection and SBOM automation solution based on code similarity analysis.
Rather than relying on dependency declarations, it compares the structure of the source code itself to identify even copied or modified open source at the function level.
Function-level code similarity matching
By analyzing at the function level rather than the file level, it distinguishes and identifies even multiple open source components mixed within a single file.
Detection of copied and modified open source
Using structure-based matching that remains robust against variable renaming, added comments, and code restructuring, it finds modified open source.
IP protection
It extracts only the characteristic features of the source code to analyze which open source was used. As a result, your source code — your critical IP — is never transmitted externally.
Standard SBOM + vulnerability analysis
It automatically generates a CycloneDX standard SBOM and provides vulnerability (CVE) information based on NVD and OSV.
Key Functions
Code Analysis
Code-similarity-based open source detection
Even without any dependency files or package manager information in the source code, SeonCA identifies open source from the code alone.
- Unaffected by variable names, comments, or formatting
- Detects partially copied or modified code
- Identifies vendored open source copied directly into the source
- Extensive open source library database
Function-level precision analysis with minimized false positives
Because the unit of analysis is the function, identification is far more precise than file-level tools. A proprietary, model-based false-positive filter screens out incorrect matches, presenting reviewers with only trustworthy results.
- Function-level precision matching — distinguishes multiple libraries within a single file
- Quantifies confidence with a library evidence score
- Automatic similarity-based false-positive filtering
- Minimizes the burden of manually adjusting thresholds
SBOM / Vulnerability Response
Automatic standard SBOM generation
It automatically converts detection results into a CycloneDX SBOM, the international standard format. By expressing even the bundle/inclusion relationships among detected open source as dependencies, it provides a structured SBOM rather than a simple list.
- CycloneDX standard SBOM output
- Component version identification and consolidation of representative versions
- Automatic construction of dependency (bundle) relationships among open source
- Simultaneous generation of an HTML analysis report
Vulnerability (CVE) analysis
By linking the identified open source components to known vulnerability databases, it lets you grasp security risks at a glance.
- Vulnerability (CVE) mapping based on NVD and OSV
- Identification of vulnerabilities affecting each component version
- Automatic generation of vulnerability reports
Supported Scope / Standards
Scope
| Category | Supported |
|---|---|
| Target analysis language | C / C++ (specialized for embedded and firmware) |
| Unit of analysis | Function-level precision analysis |
| Analysis method | Digital-fingerprint identification in a local environment (no source code transmitted externally) |
Standards
| Category | Supported |
|---|---|
| SBOM standard | CycloneDX |
| Vulnerability data | FNVD, OSV |
| License identification | SPDX license information |
Expected Benefits
Tangible Benefits
- Identify even previously invisible open source
- By finding even copied and modified open source that package managers could not catch, you can accurately respond to SBOM submission requirements and regulations.
- Reduced review time
- With function-level precision matching and automatic false-positive filtering, it reduces the false results reviewers must check, shortening the work time.
- Source code confidentiality maintained
- It uses only the digital fingerprints of the source code needed for analysis. As a result, your source code is never leaked externally. You can use it with confidence even in security-critical environments.
- Proactive vulnerability response
- By also identifying the vulnerabilities (CVEs) linked to open source components, you can inspect security risks in advance, before release.
Implementation Support
SeonENS, as a Parasoft certified partner, provides the following services:
- Training : User training and utilization guide
Identify the Open Source Inside Your Source Code — Accurately, Now
Identify the Open Source Inside Your Source Code
Accurately, Now
With SeonCA, transparently identify the open source composition of your firmware and embedded products, and secure a trustworthy SBOM.
Through an implementation consultation, we will guide you to the best approach for your environment.
With SeonCA, transparently identify the open source composition of your firmware and embedded products, and secure a trustworthy SBOM. Through an implementation consultation, we will guide you to the best approach for your environment.