[论文解读] Cascaded Vulnerability Attacks in Software Supply Chains

Laura Baird, Armin Moin|arXiv (Cornell University)|Jan 28, 2026

Information and Cyber Security被引用 0

一句话总结

该论文将包含 SBOM 的软件组件建模为异构图，并训练 HGAT 以预测具有漏洞的组件，使用少样本 MLP 预测级联 CVE 链路，从而实现多步威胁路径的排序。

ABSTRACT

Most of the current software security analysis tools assess vulnerabilities in isolation. However, sophisticated software supply chain security threats often stem from cascaded vulnerability and security weakness chains that span dependent components. Moreover, although the adoption of Software Bills of Materials (SBOMs) has been accelerating, downstream vulnerability findings vary substantially across SBOM generators and analysis tools. We propose a novel approach to SBOM-driven security analysis methods and tools. We model vulnerability relationships over dependency structure rather than treating scanner outputs as independent records. We represent enriched SBOMs as heterogeneous graphs with nodes being the SBOM components and dependencies, the known software vulnerabilities, and the known software security weaknesses. We then train a Heterogeneous Graph Attention Network (HGAT) to predict whether a component is associated with at least one known vulnerability. Since documented multi-vulnerability chains are scarce, we model cascade discovery as a link prediction problem over CVE pairs using a multi-layer perceptron neural network. This way, we produce ranked candidate links that can be composed into multi-step paths. The HGAT component classifier achieves an Accuracy of 91.03% and an F1-score of 74.02%.

研究动机与目标

• Motivate the need to reason across SBOM components, dependencies, and vulnerabilities to uncover cascaded threats in software supply chains.
• Propose a graph-based framework that enriches SBOMs with CVE/CWE data and learns relational signals using HGAT.
• Develop a cascade discovery predictor as link prediction over CVE pairs to rank potential multi-step attack paths.
• Provide preliminary empirical evaluation demonstrating the utility of the approach and outline future directions.

提出的方法

• Convert CycloneDX SBOMs to a heterogeneous graph with nodes for components, dependencies, CVEs, and CWEs and edges DEPENDS_ON, HAS_VULNERABILITY, HAS_CWE.
• Use a Heterogeneous Graph Attention Network (HGAT) with two attention heads per edge type to predict whether a component has at least one CVE.
• Represent component, CVE, and CWE features with domain-informed metadata and graph-derived signals.
• Model cascade discovery as a link prediction task over CVE pairs using a lightweight MLP trained in a few-shot regime with positive/negative samples.

实验结果

研究问题

• RQ1 Can a heterogeneous graph model capture the relational structure between SBOM components, dependencies, CVEs, and CWEs to predict vulnerable components?
• RQ2 Can a cascade discovery predictor identify likely co-exploit CVE chains to support multi-step attack path ranking?
• RQ3 What is the impact of relational edges (e.g., DEPENDS_ON) on the accuracy of vulnerability prediction?
• RQ4 How well does the CVE-pair link predictor generalize to documented cascaded vulnerability chains?

主要发现

• HGAT-based node classification achieves 91.03% accuracy for predicting has-any-CVE.
• F1-score for the HGAT model is 74.02%.
• Cascade predictor on a seed set of documented multi-CVE chains achieves 0.93 ROC-AUC.
• Ablating dependency edges reduces positive predictions, indicating the relational structure adds signal beyond local metadata.
• Preliminary evaluation uses 200 SBOMs from Wild SBOMs and 35 documented chains for cascade evaluation.