Most of the current software security analysis tools assess vulnerabilities in isolation. However, sophisticated software supply chain security threats often stem from cascaded vulnerability and security weakness chains that span dependent components. Moreover, although the adoption of Software Bills of Materials (SBOMs) has been accelerating, downstream vulnerability findings vary substantially across SBOM generators and analysis tools. We propose a novel approach to SBOM-driven security analysis methods and tools. We model vulnerability relationships over dependency structure rather than treating scanner outputs as independent records. We represent enriched SBOMs as heterogeneous graphs with nodes being the SBOM components and dependencies, the known software vulnerabilities, and the known software security weaknesses. We then train a Heterogeneous Graph Attention Network (HGAT) to predict whether a component is associated with at least one known vulnerability. Since documented multi-vulnerability chains are scarce, we model cascade discovery as a link prediction problem over CVE pairs using a multi-layer perceptron neural network. This way, we produce ranked candidate links that can be composed into multi-step paths. The HGAT component classifier achieves an Accuracy of 91.03% and an F1-score of 74.02%.

翻译：当前大多数软件安全分析工具孤立地评估漏洞。然而，复杂的软件供应链安全威胁通常源于跨越依赖组件的级联漏洞与安全缺陷链。此外，尽管软件物料清单（SBOM）的采用正在加速，但下游漏洞发现在不同SBOM生成器和分析工具之间存在显著差异。我们提出了一种新颖的SBOM驱动安全分析方法与工具。我们基于依赖结构对漏洞关系进行建模，而非将扫描器输出视为独立记录。我们将增强型SBOM表示为异构图，其节点包括SBOM组件与依赖项、已知软件漏洞以及已知软件安全缺陷。随后训练异构图注意力网络（HGAT）以预测组件是否关联至少一个已知漏洞。由于已记录的多漏洞链稀缺，我们将级联发现建模为基于CVE对的链路预测问题，采用多层感知器神经网络实现。通过这种方式，我们生成可排序的候选链接，这些链接可组合成多步路径。HGAT组件分类器实现了91.03%的准确率与74.02%的F1分数。