AI-Powered Software Composition Analysis (SCA) Platform
An AI-powered Software Composition Analysis platform that analyzes software dependencies, predicts dependency risk using machine learning, identifies known vulnerabilities, generates SBOMs, checks licenses, and provides remediation recommendations.
Project Overview
Modern applications depend heavily on open-source software libraries. A vulnerable or poorly maintained dependency can introduce security risks into an application.
This project provides an integrated SCA platform that:
Extracts dependencies from project files Collects dependency metadata Checks known vulnerabilities using CVE intelligence Uses EPSS scores to assess vulnerability exposure Predicts dependency risk using an ensemble machine learning model Generates CycloneDX SBOMs Checks software licenses Suggests safer dependency versions Provides remediation recommendations Generates security reports in PDF format Visualizes dependency relationships and risk Stores scan history for comparison Key Features
- Dependency Analysis
The platform supports dependency analysis from:
requirements.txt package.json CSV dependency files
Each dependency is analyzed using available package and vulnerability information.
- AI-Based Risk Prediction
The platform uses a soft-voting ensemble machine learning model consisting of:
Random Forest Extra Trees
The model predicts one of three dependency risk levels:
Label Risk 0 Low 1 Medium 2 High
The prediction is based on engineered dependency and maintenance features rather than relying only on predefined security rules.
- Feature Engineering
The ML pipeline derives dependency characteristics such as:
GitHub stars Forks Open issues Number of contributors Package age Update frequency CVE count CVE presence Critical CVE indicators Issue ratio Maintenance indicators Staleness indicators Contributor and popularity indicators
The current model uses 26 engineered features.
- Vulnerability Intelligence
The platform integrates vulnerability information from sources including:
NVD OSV EPSS
The vulnerability analysis provides information such as:
CVE IDs Vulnerability count Severity information EPSS score Critical vulnerability indicators 5. SBOM Generation
The platform generates a Software Bill of Materials (SBOM) using the CycloneDX 1.5 format.
Supported input formats include:
requirements.txt package.json CSV
The generated SBOM contains dependency information such as:
Package name Version Package URL (PURL) Ecosystem Component type 6. License Compliance
Dependencies can be checked for license information to help identify potentially problematic licenses such as restrictive or copyleft licenses.
- Version Recommendation
The platform provides safer-version recommendations for dependencies where suitable version information is available.
- Remediation Recommendations
The platform provides recommendations based on detected dependency risks, vulnerabilities, outdated versions, and other security indicators.
- Dependency Graph
An interactive dependency graph visualizes:
Project dependencies Dependency risk levels Associated CVEs Vulnerability relationships 10. Scan History and Comparison
Previous scans can be stored and compared to identify:
New dependencies Removed dependencies Version changes Risk changes Vulnerability changes