Context-aware risk assessment of third-party software components based on call-graph reachability and ensemble machine learning

Modern software products consist mostly of third-party and open-source components, and every vulnerability in a transitive dependency may become a risk for the final application. Tools for software composition analysis detect known vulnerabilities, but they produce long lists of alerts, many of which concern code that the application never executes. The aim of this study is to design an intelligent system that assesses the risk of software components in the context of a particular application. The proposed approach builds a dependency graph from a software bill of materials, supplements it with a call graph, and merges reachability, exploit probability, severity and repository reputation features in a gradient-boosting ensemble.