Machine learning-based approach to characterize software supply chain risk

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• unpacking the software package into a plurality of components, each of the components comprising a plurality of functions;
• individually lifting each function of each component into a corresponding intermediate representation, the lifting comprising decoding machine code bytes corresponding to the function into a higher level intermediate representation instruction, wherein the intermediate representation is in expression static single-assignment (SSA) form and, during the lifting, a control-flow graph (CFG) and a data-flow graph (DFG) for each function are reconstructed;
• generating, for each intermediate representation using an embedding machine learning model, an embedding preserving code semantics from the corresponding component, wherein a single component has multiple different corresponding intermediate representations which each corresponds to a different one of the associated plurality of functions, wherein the embedding is generated directly from tokenized intermediate representation in SSA;
• extracting or deriving, from each intermediate representation, intermediate representation derive data flow features indicative of supply chain risk comprising at least one of:
• detection of constant static variables on a stack, stack reaching definitions, uninitialized variables, and intra-procedural aliases for identifying the component;
• inputting, on a component by component basis, the extracted or derived features for the component along with the embedding into at least one machine learning model to generate a level of supply chain risk associated with the component, the at least one machine learning model being trained using a plurality of attributes including code semantic properties derived from a corpus of software packages;
• and
• providing data characterizing the generated level of supply chain risks to a consuming application or process, the generated level of supply chain risks being used to identify software supply chain vulnerabilities.

A computer-implemented method for identifying software supply chain risk comprising:

• receiving a software package;
• unpacking the software package into a plurality of components;
• preprocessing each component to annotate the component with contextual information about encapsulated or utilized functions based on information stored in a semantic analyses database and at least one of a type database and a debugging database;
• extracting or deriving, from each component, features indicative of supply chain risk;
• inputting, for each of the functions on a component by component basis, the corresponding features into at least one machine learning model to generate a level of supply chain risk associated with the component;
• and
• providing data characterizing the generated level of supply chain risks to a consuming application or process, the at least one machine learning model being trained using a plurality of attributes including code semantic properties derived from a corpus of software packages;
• wherein the extracted or derived features characterize each of:
• (i) a data flow graph and a control flow graph connecting function calls within each component to a specific order or data usage, and (ii) behavioral attributes including a purpose of specific application programming interface (API) calls from an operating system or firmware.