SBOM generation based on code-level external component trees

A huge body of research and engineering efforts have been dedicated to extract and utilize software bill of materials (SBOM) due to the requirement of supply chain security. Existing approaches primarily rely on property files from dependency management tools, e.g., pom.xml from Maven, to generate SBOMs. However, the effectiveness of SBOM is directly affected by the bloated dependency and missing dependency problems during dependency management. In this work, we propose a source code-based approach to SBOM generation that only focuses on identifying the actually used external components. To support this, we introduce a novel structure called the external component tree (ECT), which organizes code-level dependency declarations at scale. We design three filters to eliminate programming language native, project-specific, and unused external components, and further applies subtree trimming algorithms to extract representative components from complex dependency hierarchies. Our approach is evaluated on 30 open-source projects in Java, Python, and Scala languages, comparing with CycloneDX-Generator, OpenRewrite, Build-Info-Go, and Microsoft SBOM-Tool. The results show that all SBOMs generated by our approach are correct, successfully addressing the bloated dependencies in the experiments. Furthermore, our method achieves a recall rate of 99.8%, the highest among all evaluated tools, indicating minimal component omission of actual software dependencies.