Multi-Agent Artificial Intelligence (AI) Generation of Software Bill of Materials (SBOM)
Open Access DepositedOver the years software systems have experienced a significant complexity growth enabled by widespread reuse of open-source software (OSS) components and modular frameworks which enabled time reduction in development while at the same time introducing significant challenges in the software supply chain in the area of security vulnerabilities and licensing compliance management. One frequently encountered challenge is a lack of detailed inventories of software components with their dependencies and related licensing information. Different solutions were proposed to address this challenge, where the software bill of materials (SBOM) approach has gained the most traction in the industry as a go-to tool that provides detailed information about software composition and licensing terms. Despite its recognition, the SBOM adoption rate is low with key concern raised about inconsistent quality of SBOM documents.This praxis proposes solution that mitigates the SBOM quality concerns with a multi-agent AI SBOM tool which leverages large language models’ (LLM’s) reasoning capabilities and arrangement of sequentially collaborating AI agents to enhance the accuracy and completeness of the SBOM. The proposed system aims to improve key SBOM quality parameters that include precision and recall for dependency detection and licensing identification by performing analysis directly on the source code and combining outputs from multiple agents. In order to quantify the improvement of the method the results are evaluated against existing widely used SBOM tools on the validation dataset prepared in this praxis. Aside from SBOM quality metrics evaluation, the praxis assesses the feasibility of implementing the AI agents with open-weight models to reduce the usage cost with smaller quantized models instead of powerful commercial models like GPT4o or Gemini-Flash.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.