UniBOM -- A Unified SBOM Analysis and Visualisation Tool for IoT Systems and Beyond

TL;DR

UniBOM is an innovative tool that enhances SBOM analysis and visualization for IoT and complex systems by integrating binary, source, and filesystem analysis, improving vulnerability detection and security management.

Contribution

UniBOM introduces a comprehensive SBOM tool with binary and source analysis, AI-based vulnerability classification, and support for non-package-managed languages, advancing security in networked systems.

Findings

Superior vulnerability detection in IoT firmware

Effective analysis of non-package-managed C/C++ dependencies

Enhanced security accountability through unified visualization

Abstract

Modern networked systems rely on complex software stacks, which often conceal vulnerabilities arising from intricate interdependencies. A Software Bill of Materials (SBOM) is effective for identifying dependencies and mitigating security risks. However, existing SBOM solutions lack precision, particularly in binary analysis and non-package-managed languages like C/C++. This paper introduces UniBOM, an advanced tool for SBOM generation, analysis, and visualisation, designed to enhance the security accountability of networked systems. UniBOM integrates binary, filesystem, and source code analysis, enabling fine-grained vulnerability detection and risk management. Key features include historical CPE tracking, AI-based vulnerability classification by severity and memory safety, and support for non-package-managed C/C++ dependencies. UniBOM's effectiveness is demonstrated through a comparative vulnerability analysis of 258 wireless router firmware binaries and the source code of four popular IoT operating systems, highlighting its superior detection capabilities compared to other widely used SBOM generation and analysis tools. Packaged for open-source distribution, UniBOM offers an end-to-end unified analysis and visualisation solution, advancing SBOM-driven security management for dependable networked systems and broader software.