Problem
Research questions and friction points this paper is trying to address.
Software Composition Analysis
Lifecycle Stages
Component Evolution
Dependency Resolution
Supply-Chain Security
From Component Snapshots to Lifecycle Traces: Agent-Based Software Composition Analysis
🤖 AI Summary
为了解决软件供应链安全问题，本文提出SCA-Agent方法，通过构建组件生命周期轨迹来提高第三方组件识别及演变理解的准确性。
📝 Abstract
Software supply-chain security requires accurate identification of third-party components and an understanding of how they evolve from development to execution. Existing software composition analysis (SCA) approaches examine manifests, build environments, release artifacts, containers, or runtime states, but typically produce only stage-specific views of software composition. As dependencies are resolved, removed, repackaged, and transformed across lifecycle stages, a single snapshot cannot capture both where a component originates and where it ultimately ends up. Combining snapshots from multiple stages still leaves their cross-stage relationships unresolved. We present SCA-Agent, an agent-based approach to lifecycle-aware SCA that reconstructs evidence-backed component lifecycle traces across Code, Build, Release, Deploy, and Runtime. SCA-Agent adaptively explores project-specific analysis paths, gathers stage-specific evidence, and correlates observations across stages to recover component identities, versions, introduction paths, propagation relationships, and final lifecycle states. We evaluate SCA-Agent on 105 real-world projects from the Java, JavaScript, and Python ecosystems. SCA-Agent achieves the highest component detection F1 across all lifecycle stages and ecosystems. For vulnerability exposure assessment, it reaches an F1 score of 96.69%, exceeding the best traditional SCA tool by 18.76 percentage points. These results show that lifecycle-aware SCA supports traceable component provenance and more accurate software supply-chain risk assessment.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Agent-based approach
Lifecycle-aware SCA
Component lifecycle traces
Software supply-chain security
Vulnerability exposure assessment
🔎 Similar Papers
No similar papers found.
