Work

Context-aware risk assessment of third-party software components based on call-graph reachability and ensemble machine learning

Year: 2026

Type: preprint

Abstract: Modern software products consist mostly of third-party and open-source components, and every vulnerability in a transitive dependency may become a risk for the final application. Tools for software composition analysis detect known vulnerabilities, but they produce long lists of alerts, many of which concern code that the application never executes. The aim of this study is to design an intelligent system that assesses the risk of software components in the context of a particular application. The proposed approach builds a dependency graph from a software bill of materials, supplements it with a call graph, and merges reachability, exploit probability, severity and repository reputation features in a gradient-boosting ensemble.

Source: Zenodo (CERN European Organization for Nuclear Research)

DOI: 10.5281/zenodo.24138774

Authors: Kim, Nikita P., Tuleutay, Rustam A., Makhmutov, Sanzhar O., Sabyr, Rinat A.

Institution: Satbayev University

Language: English

Topic: Software Engineering Research

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W7225777989

Cites:

Cited by:

Related to: