Scholarlink

<p>A huge body of research and engineering efforts have been dedicated to extract and utilize software bill of materials (SBOM) due to the requirement of supply chain security. Existing approaches primarily rely on property files from dependency management tools, e.g., <i>pom</i>.<i>xml</i> from Maven, to generate SBOMs. However, the effectiveness of SBOM is directly affected by the bloated dependency and missing dependency problems during dependency management. In this work, we propose a source code-based approach to SBOM generation that only focuses on identifying the actually used external components. To support this, we introduce a novel structure called the external component tree (ECT), which organizes code-level dependency declarations at scale. We design three filters to eliminate programming language native, project-specific, and unused external components, and further applies subtree trimming algorithms to extract representative components from complex dependency hierarchies. Our approach is evaluated on 30 open-source projects in Java, Python, and Scala languages, comparing with CycloneDX-Generator, OpenRewrite, Build-Info-Go, and Microsoft SBOM-Tool. The results show that all SBOMs generated by our approach are correct, successfully addressing the bloated dependencies in the experiments. Furthermore, our method achieves a recall rate of 99.8%, the highest among all evaluated tools, indicating minimal component omission of actual software dependencies.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

SBOM generation based on code-level external component trees

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年11月24日

查看全文
  • Xianglong Kong,
  • Hangyi Zhuo,
  • Xinyuan Miao,
  • Wei Huang,
  • Jiayu Du

摘要

A huge body of research and engineering efforts have been dedicated to extract and utilize software bill of materials (SBOM) due to the requirement of supply chain security. Existing approaches primarily rely on property files from dependency management tools, e.g., pom.xml from Maven, to generate SBOMs. However, the effectiveness of SBOM is directly affected by the bloated dependency and missing dependency problems during dependency management. In this work, we propose a source code-based approach to SBOM generation that only focuses on identifying the actually used external components. To support this, we introduce a novel structure called the external component tree (ECT), which organizes code-level dependency declarations at scale. We design three filters to eliminate programming language native, project-specific, and unused external components, and further applies subtree trimming algorithms to extract representative components from complex dependency hierarchies. Our approach is evaluated on 30 open-source projects in Java, Python, and Scala languages, comparing with CycloneDX-Generator, OpenRewrite, Build-Info-Go, and Microsoft SBOM-Tool. The results show that all SBOMs generated by our approach are correct, successfully addressing the bloated dependencies in the experiments. Furthermore, our method achieves a recall rate of 99.8%, the highest among all evaluated tools, indicating minimal component omission of actual software dependencies.