Patent ID: 11966475
Assignee: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 10:
11. A system comprising:
a processor; and
a memory to store instructions, that when executed by the processor, cause the processor to:
determine a degree of trust of a software component based on security level parameters;
determine a degree of security of the software component based on security level parameters, wherein:
the trust parameters represent at least one of a repository reputation of the software component, a maturity of a community associated with the software component, a reputation of a certificate authority signing the software component, support for download of the software component over a secure connection, whether the community is obsolete, common vulnerabilities and exposures (CVEs) vulnerability management practices, a responsiveness to new CVE entries, a maturity of documented safe download practices corresponding to the software component, support for integrity verification of the software component, or an obsolescence risk of the software component; and
at least one parameter of the security level parameters and the trust Parameters is unavailable;

apply a machine learning classifier to infer the at least one parameter;
determine a risk score for the software component based on the degree of trust and the degree of security;
determine a security context of a product that plans to use the software component;
apply a set of rules to the risk score and the security context; and
based on the application of the set of rules, provide a recommendation for the software component.