Machine learning models predict chained vulnerabilities in software supply chains

Security researchers have developed a novel method to identify how multiple vulnerabilities can be chained together to compromise software systems. Rather than treating each known flaw in isolation, the approach leverages the structure of software dependency graphs to uncover cascading attack paths that emerge from interdependent components.

The Problem with Current Security Analysis#

Most security scanning pipelines that analyze Software Bill of Materials (SBOM) documents treat each vulnerability as a standalone finding. This fragmented approach misses a critical threat: cascading vulnerabilities where multiple flaws in connected components combine to enable more sophisticated attacks. The research published on arXiv addresses this gap by proposing a graph-based learning framework.

A Graph-Based Detection Approach#

The team converted vulnerability-enriched CycloneDX SBOMs—detailed inventories of software dependencies—into heterogeneous graphs. These graphs represent:

• Software components and their known CVEs (Common Vulnerabilities and Exposures) as nodes
• Dependencies and vulnerability relationships as typed connections

Two machine learning models work together to predict attack chains:

• Heterogeneous Graph Attention Network (HGAT): Identifies whether a component carries at least one known vulnerability, serving as an initial feasibility check
• Multi-Layer Perceptron (MLP): Predicts which pairs of vulnerabilities could form dangerous chains based on patterns in documented attacks

Validation Results#

The researchers tested their approach on 200 real-world SBOMs from the public Wild SBOMs dataset. The HGAT classifier achieved 91.03% accuracy and a 74.02% F1-score for component vulnerability detection. The cascade prediction model reached a ROC-AUC of 0.93 when trained on 35 documented multi-vulnerability attack chains, indicating strong performance in identifying linked exploits.