Graph Learning Method Predicts Multi-Vulnerability Attack Chains from SBOMs
A new preprint introduces a graph-learning approach to predict cascading vulnerabilities in software supply chains using Software Bill of Materials (SBOM) data. The researchers represent SBOMs as heterogeneous graphs and use a Heterogeneous Graph Attention Network (HGAT) to classify vulnerable components with 91% accuracy. They also employ a Multi-Layer Perceptron (MLP) to predict multi-vulnerability attack chains, achieving a ROC-AUC of 0.93 on documented cases.
Why it matters: This work demonstrates a novel method for proactively identifying complex vulnerability chains in software supply chains, potentially improving security analysis beyond current per-CVE approaches.
Full story at: arXiv Cryptography and Security ↗