Description
As software development increasingly relies on third-party components, the Software Bill of Materials
(SBOM) has emerged as a critical tool for managing supply chain risk and meeting regulatory requirements.
However, the adoption of SBOMs frequently results in data overload, overwhelming security teams with
unprioritized vulnerability alerts. Current prioritization methods typically rely on static severity scores like
CVSS or linear weighted sums, which fail to account for the specific structural context of the software or the
dynamic nature of active threats.
To address these limitations, this thesis proposes the Hybrid Decision-Fusion Model (HDFM), a novel
decision-support framework designed to systematically prioritize SBOM vulnerabilities without requiring
runtime instrumentation. The HDFM establishes a logical process analyzing risk through five sequential
phases. First, the ingestion phase processes and normalizes standard SBOM formats (e.g., CycloneDX)
into a unified internal representation. Second, the structural analysis phase reconstructs the software’s
dependency graph to calculate a Topological Criticality Score (TCS), quantifying the potential systemic
impact, or blast radius, of a component failure. Third, the framework enriches the data by integrating
external threat intelligence, including remediation data from OSV.dev, exploitability probabilities from EPSS,
active exploitation status from the CISA KEV catalog, and component obsolescence indicators.
Fourth, the dynamic scoring phase applies the Shannon Entropy Weight Method to assign objective weights
based on dataset variance. This effectively neutralizes uniform data and highlights the distinguishing risk
factors. This step mathematically fuses structural, severity, and exploitability metrics into a single aggregate
risk score. Finally, the decision phase categorizes findings into definitive severity tiers—Critical, High,
Medium, and Low—using a logical decision matrix and Dynamic Quantile Ranking to elevate active threats
and downgrade highly improbable risks.
A Proof-of-Concept (PoC) tool was developed to validate the HDFM algorithm. Guided evaluation using
synthetic SBOM archetypes demonstrated the model’s ability to consistently identify structurally central risks,
suppress false alarms from unreachable vulnerabilities, and promote actively exploited threats. Testing
against real-world SBOMs further validated the framework’s effectiveness in identifying latent risks, such as
deprecated components. The results indicate that the HDFM provides a more discriminating, context-aware,
and operationally meaningful ordering of vulnerabilities compared to traditional static methods. Furthermore,
the relationships between the model’s parameters were analyzed to evaluate the mathematical tradeoffs,
specifically quantifying the operational gains and losses associated with applying custom weighting
configurations.
|
