AutoCrypt Security Analyzer is a vulnerability scanning solution that analyzes vehicle software and generates software bills of materials (SBOM) for risk management. The system identifies and manages vulnerabilities in vehicular open-source software by detecting, categorizing, and listing software components. It operates across all stages of the software development lifecycle and performs multi-factor vulnerability analysis using component, library, file, and function analysis units. The solution includes a vulnerability database that stores vulnerability information from CVE, NVD, MITRE, and Bugzilla sources, along with machine learning-based patches and open-source component data. The scanner analyzes source code copies stored as encrypted files and supports all programming languages. It performs vulnerability analysis on individual files and functions using VUDDY and CENTRIS technology. The system identifies open-source components and licenses within software and supports SPDX and CycloneDX formats. After analysis, it provides recommended patches for discovered security risks and detailed vulnerability guides for manual code fixes. The solution enables automotive OEMs to detect and eliminate open-source software vulnerabilities during development stages and provides continuous software management throughout the vehicle lifecycle.
