LLM-Enhanced Evolutionary Dependency Graphs: A System Approach to Precise Vulnerability Propagation Tracking
TL;DR
The LLM-Enhanced Component Dependency Evolution Graph (CDEG) framework is proposed, a hybrid representation that fuses structural features extracted by Tree-sitter with semantic embeddings derived from a fine-tuned LLM, effectively distinguishing backported patches from code refactoring.
Abstract
With the widespread adoption of open-source software (OSS), software supply chain attacks have become increasingly sophisticated, posing severe threats to digital infrastructure. Traditional Software Composition Analysis (SCA) tools and Software Bill of Materials (SBOM) systems face critical limitations, including disconnection between static metadata and dynamic code evolution, inability to detect silent fixes and backported patches, and LLM-induced hallucinations in vulnerability detection. To address these challenges, this paper proposes the LLM-Enhanced Component Dependency Evolution Graph (CDEG) framework. The system constructs a time-aware heterogeneous graph by parsing SBOMs to establish static dependency edges and linking version lineages to model temporal evolution. Within this framework, we map code patches using a hybrid representation that fuses structural features extracted by Tree-sitter with semantic embeddings derived from a fine-tuned LLM, effectively distinguishing backported patches from code refactoring. Experimental results on the SC-Vuln-Real dataset demonstrate that our framework achieves 88.4% recall for backported patch detection and achieves an F1-Score of 93.8% in container image scanning.