Chain-of-Experts (CoE): Reverse Engineering Software Bills of Materials for JavaScript Application Bundles through Code Clone Search
Leo Song, Steven H. H. Ding, Yuan Tian, Li Tao Li, Philippe Charland,, Andrew Walenstein

TL;DR
This paper introduces Chain-of-Experts (CoE), a multi-task deep learning approach for reverse-engineering software bills of materials from JavaScript application bundles, addressing key challenges like nested code and large search spaces.
Contribution
The study presents the first scalable, end-to-end deep learning solution for generating SBoMs from JavaScript bundles, outperforming task-specific methods in efficiency.
Findings
CoE achieves competitive results with less training and inference time.
It effectively handles nested code scopes and long sequences.
Demonstrates scalability on real-world web application bundles.
Abstract
A Software Bill of Materials (SBoM) is a detailed inventory of all components, libraries, and modules in a software artifact, providing traceability throughout the software supply chain. With the increasing popularity of JavaScript in software engineering due to its dynamic syntax and seamless supply chain integration, the exposure to vulnerabilities and attacks has risen significantly. A JavaScript application bundle, which is a consolidated, symbol-stripped, and optimized assembly of code for deployment purpose. Generating a SBoM from a JavaScript application bundle through a reverse-engineering process ensures the integrity, security, and compliance of the supplier's software release, even without access to the original dependency graphs. This paper presents the first study on SBoM generation for JavaScript application bundles. We identify three key challenges for this task, i.e.,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsScientific Computing and Data Management · Software Engineering Research · Advanced Malware Detection Techniques
