A Reality Check on SBOM-based Vulnerability Management: An Empirical Study and A Path Forward
For software supply chain security practitioners, the paper identifies a critical flaw in current SBOM-based vulnerability scanning and offers a practical mitigation, though the approach is incremental.
The paper empirically evaluates SBOM-based vulnerability management on 2,414 open-source repositories, finding that downstream scanners have a 92.0% false positive rate primarily due to unreachable code. It shows that function call analysis can prune 61.9% of false alarms, proposing a two-stage approach for more actionable reports.
The Software Bill of Materials (SBOM) is a critical tool for securing the software supply chain (SSC), but its practical utility is undermined by inaccuracies in both its generation and its application in vulnerability scanning. This paper presents a large-scale empirical study on 2,414 open-source repositories to address these issues from a practical standpoint. First, we demonstrate that using lock files with strong package managers enables the generation of accurate and consistent SBOMs, establishing a reliable foundation for security analysis. Using this high-fidelity foundation, however, we expose a more fundamental flaw in practice: downstream vulnerability scanners produce a staggering 92.0\% false positive rate in our case study. We pinpoint the primary cause as the flagging of vulnerabilities within unreachable code. We then demonstrate that function call analysis can effectively prune 61.9\% of these false alarms. Our work validates a practical, two-stage approach for SSC security: first, generate an accurate SBOM using lock files and strong package managers, and second, enrich it with function call analysis to produce actionable, low-noise vulnerability reports that alleviate developers' alert fatigue.