DeepSCA: Dependency-Aware Software Composition Analysis for C/C++ Based on a Curated Code Feature Database

Abstract

Software Composition Analysis (SCA) identifies reused third-party libraries (TPLs) and their dependencies, forming the basis of Software Bills of Materials (SBOMs) for securing software supply chain. Current C/C++ SCA techniques extract code features and match them against a TPL feature database. However, detection recall is limited by feature database coverage, and two key challenges remain: (1) Coverage-Precision Trade-off: Feature databases built from a single repository (e.g., GitHub) often yield high false negatives, as C/C++ TPLs are inherently distributed across diverse hosting platforms (e.g., Debian, ArchLinux, and Xrepo), each offering partially overlapping yet distinct sets of TPLs. Although a multi-repository feature database improves TPL coverage, it inevitably introduces numerous shared functions (e.g., cross-TPL code clones) that map to a broader set of candidate origins. When coupled with the limitations of existing SCA techniques in tracing provenance, this ambiguity further increases false positives. (2) Neglected Dependency Context: Existing SCA techniques primarily focus on detecting reused TPLs but often overlook their inter-dependencies. However, license compatibility constraints are inherently determined by directed dependency relationships among TPLs. DeepSCA addresses Challenge 1 by constructing a feature database with 66,143,596 functions extracted from 33,100 C/C++ TPLs, covering nine mainstream hosting repositories. To reduce false positives from shared functions, DeepSCA groups TPLs with shared code, and uses distinctiveness scores to trace functions to their origins—ensuring high precision without sacrificing recall. To overcome Challenge 2, DeepSCA generates the dependency graph from the detected TPLs. it resolves filename ambiguity by simulating compiler header search paths and mitigates symbol ambiguity via namespace-aware resolution, enabling accurate file-level dependency mapping to TPLs. Evaluated on a ground-truth dataset of 335 OpenHarmony projects (10,583 TPLs, 64,200 dependencies), DeepSCA achieves 85.6% precision and 87.3% recall for TPL detection, outperforming state-of-the-art tools (e.g., 16.8% precision and 21.1% recall improvement over TPLite). Its dependency graphs reach 91.8% precision, surpassing Cneps by 11.3%. Moreover, the dependency graph generated by DeepSCA uncovers previously hidden combinations of license incompatibility issues in real-world projects.