From Component Snapshots to Lifecycle Traces: Agent-Based Software Composition Analysis

• Snapshots at different stages reveal complementary evidence: earlier stages show dependency origins, while later stages better establish whether components reach downstream software.Build evidence can identify dependency chains but not confirm survival through packaging; runtime evidence indicates execution but may lack provenance context.Source: §1 · pp. 1–2
• Project-specific analysis paths and heterogeneous component representations require adaptive exploration and cross-stage evidence association.Source: §1 · p. 2
• 96.69% F1 for vulnerability exposure assessment exceeded the best traditional SCA tool by 18.76 percentage points.Source: §1 · p. 2
• SCA-Agent evaluates lifecycle traces across 105 real-world projects in Java, JavaScript, and Python, with adaptive planning and cross-stage reasoning.Source: §1 · p. 2
• SCA-Agent gathers evidence across Code, Build, Release, Deploy, and Runtime, then resolves component identities, versions, and propagation relationships into lifecycle traces.Source: §1 · p. 2

2.1 Motivating Example

• Among 173 CVEs matched at Build in the example project, 94 (54.3%) involved vulnerable components absent from the Release artifact.A Build snapshot alone cannot establish whether a vulnerable component reaches delivered software.Source: §2.1 · p. 3
• Later-stage snapshots can confirm that jackson-databind@2.13.5 persists, but build resolution traces its introduction through spring-boot-actuator-autoconfigure@2.7.18 to spring-boot-starter-actuator@2.7.18.The transitive component is not directly declared by the project, so later-stage presence alone does not identify the actionable upgrade point.Source: §2.1 · p. 3

2.2 Software Composition as Lifecycle Context

• Component security context connects Origin, the dependency relationship or process introducing a component, with Fate, its persistence across later stages and final destination.Source: §2.2 · p. 3
• Evidence for a component’s introduction and later presence is distributed across lifecycle stages, so no single-stage snapshot can establish both Origin and Fate.Source: §2.2 · pp. 3–4
• The model abstracts composition evolution into Code, Build, Release, Deploy, and Runtime, excluding Plan, Test, and combining Operate and Monitor as Runtime.The abstraction selects lifecycle states that produce distinguishable composition evidence.Source: §2.2 · pp. 3–4

3.1 Overview

• SCA-Agent combines adaptive planning, stage-aware evidence collection, cross-stage reasoning, and lifecycle-aware SBOM construction to reconstruct component traces.Source: §3.1 · p. 4

3.2 Adaptive Lifecycle Planning

• Adaptive planning inspects project structure and delivery configuration, then updates its exploration using newly discovered objects and analysis feedback.When progress stalls or evidence is insufficient, it can change parameters, tools, targets, or lifecycle objects; exploration is capped at 30 iterations.Source: §3.2 · pp. 4–5

3.3 Stage-aware Evidence Collection

• Stage-aware collection preserves each component observation with its lifecycle stage, source object, and evidence path rather than merging observations during collection.The preserved context supports tracing results back to the relevant file, artifact, or runtime object.Source: §3.3 · p. 5

3.4 Cross-stage Component Reasoning

• Cross-stage reasoning normalizes heterogeneous identities, resolves concrete versions using declarations, build results, and downstream evidence, then reconstructs Origin, Propagation, and Fate.Fate includes removal, inclusion in delivered artifacts, deployment, or loading or execution at Runtime.Source: §3.4 · pp. 5–6

3.5 Lifecycle-aware SBOM Construction

• The lifecycle-aware SBOM retains standard component and dependency fields while adding stage states, introduction source, propagation relationships, and supporting evidence paths.Source: §3.5 · p. 6

4.1 Experimental Setup

• The evaluation covers 105 projects—35 each from Java, JavaScript, and Python—with 58,211 stage-level dependency instances and 17,482 CVE-stage ground-truth instances.Projects were analyzed at Code, Build, Release, Deploy, and Runtime; annotators reviewed stage dependencies and resolved disagreements by consensus.Source: §4.1 · pp. 6–7

4.2 Lifecycle Dependency Evolution

• 32,715 Build observations versus 3,891 Code, followed by 8,063 Release, 8,809 Deploy, and 4,733 Runtime observations, show composition changes across stages.Retained-component counts and Jaccard similarity also indicate instability: Python’s adjacent-stage similarities range from 22.57%–48.10%, while Java’s 98.29% Release-to-Deploy similarity does not imply stability elsewhere.Source: Table 1 · p. 7, §4.2 · pp. 7–8, Table 2 · p. 8

4.3 Ablation Study

• Removing adaptive planning substantially degrades later-stage detection, while removing cross-stage reasoning weakens component identity resolution and lifecycle recovery.Planning supports continued evidence discovery; reasoning associates distributed evidence to reconstruct component identities and lifecycle context.Source: §4.3 · pp. 8–9, Figure 3 · p. 9

4.4 Component Detection Comparison

• SCA-Agent achieves the highest F1 across all five lifecycle stages and all three language ecosystems, while traditional tools generally weaken after Build.At Java Build, cdxgen’s F1 of 0.957 is close to SCA-Agent’s 0.959; SCA-Agent’s stage-specific analysis supports stronger later-stage detection.Source: Figure 4 · p. 10, §4.4 · p. 10

4.5 Lifecycle Trajectory Recovery

• 84.44%–99.11% Origin Accuracy and 70.94%–97.95% Fate Accuracy: SCA-Agent substantially outperforms traditional tools across the three ecosystems.Cross-stage reasoning traces components to their introduction points, while adaptive planning extends evidence collection to determine their final lifecycle states.Source: Table 3 · p. 11, §4.5 · p. 11

4.6 Lifecycle-aware Vulnerability Assessment

• 96.69% F1: SCA-Agent improves vulnerability exposure assessment by 18.76 percentage points over the best traditional tool.It achieves 99.13% Precision and 94.37% Recall; cdxgen’s F1 is 77.93%, with 9,710 false positives versus SCA-Agent’s 145.Source: §4.6 · pp. 11–12, Table 4 · p. 12
• SCA-Agent achieves an F1 of 96.69%, outperforming traditional SCA tools by 18.76–80.69 percentage points.Recovering dependency Origin and Fate helps identify actual vulnerability propagation and persistence, reducing erroneous extension of vulnerabilities that have disappeared and omissions of real exposures.Source: §4.6 · p. 12

Toward Self-Evolving SCA-Agent

• SCA-Agent currently depends on manually constructed domain knowledge, which is difficult to maintain comprehensively as software ecosystems evolve.A proposed self-evolving agent would learn from prior execution paths, failures, and dependency-evolution patterns to update its knowledge and planning.Source: §5 · p. 12

Dataset and Ground-truth Reliability

• Runtime observations may remain workload-dependent, and dependency resolution can vary across operating systems, package managers, and execution environments.The evaluation uses execution scripts to exercise major functionality, cross-validates annotations, and holds the experimental environment constant, but these measures cannot eliminate all ground-truth uncertainty.Source: §5 · p. 12

Cost–Benefit Trade-off of SCA-Agent

• SCA-Agent’s analysis adds LLM reasoning, planning, and cross-stage correlation overhead, averaging about $0.85 and five minutes per project.The authors report that improved CVE assessment accuracy can partially offset this additional cost in security-sensitive scenarios.Source: §5 · p. 12

Supporting Deeper Supply-chain Security Analysis

• The current analysis assesses vulnerability exposure at the component level, not vulnerable-code reachability or whether execution can trigger a vulnerability.Those questions require additional program-level evidence, including call relationships, dynamic execution traces, and vulnerability-specific triggering conditions.Source: §5 · pp. 12–13

Software Composition Analysis

• Traditional SCA analyzes declarations and other representations, and results can differ substantially across tools even for the same software object.Tools have expanded from manifests and lockfiles to packages, file systems, build environments, and container images.Source: §6 · p. 13

Complementary Evidence Sources

• Research has explored complementary component evidence from incremental SBOMs, firmware and IoT, containers, binaries, and runtime observation.Runtime approaches address components that static analysis alone may miss, including dynamically loaded, reflectively injected, or runtime-resolved components.Source: §6 · p. 13

Lifecycle-aware SCA

• Existing approaches mainly gather stage-specific evidence independently, leaving complete origin, propagation, and fate traces unresolved.The remaining challenge is correlating component evidence as it evolves from introduction and build through release, deployment, and runtime.Source: §6 · p. 13

7 Conclusion

• SCA-Agent consistently improves component detection and achieves 96.69% F1 for vulnerability exposure assessment, 18.76 percentage points above the best traditional SCA tool.The evaluation covers 105 real-world projects.Source: §7 · p. 13
• SCA-Agent reconstructs component traces across Code, Build, Release, Deploy, and Runtime using adaptive planning and cross-stage reasoning.The authors describe lifecycle-aware SCA as a more accurate and traceable foundation for software supply-chain security analysis.Source: §7 · p. 13

A Open Science

• Core prompts, agent configurations, and representative experience files are available in an anonymous repository for reproducing the workflow.The materials are described as supporting understanding and reproduction of the analysis workflow.Source: A Open Science · p. 14