What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security
2026-06-22 • Cryptography and Security
Cryptography and SecuritySoftware Engineering
AI summaryⓘ
The authors explain that software often uses parts from other sources, which can introduce security risks. To better understand what software is actually running, they created MEM-SBOM, a tool that looks directly at a program's memory while it's running to list the parts it uses. This method shows more accurate details than existing tools because it sees what the program actually loads and runs, especially for Python apps. Their tests showed MEM-SBOM works perfectly and can spot risky functions that other tools miss. This approach helps improve security by giving a clearer picture of software components at runtime.
Software Bill of Materials (SBOM)Software supply chainPython runtimeMemory forensicsDependency graphBytecode analysisVolatility 3Software vulnerabilitiesIncident responseDynamic ecosystems
Authors
Hala Alia, Andrew Case, Irfan Ahmed
Abstract
Modern software development relies heavily on third-party components from public repositories, expanding the software supply chain attack surface. In response to these growing risks, federal initiatives have advanced the Software Bill of Materials (SBOM) as a standardized mechanism for improving transparency by describing software components, dependencies, and their relationships. However, SBOMs built from metadata or filesystem artifacts fail to capture the components loaded and executed at runtime, especially in dynamic ecosystems such as Python. Moreover, generating runtime SBOMs through instrumentation requires monitoring to be deployed in advance and the system to remain observable throughout execution. Such conditions are difficult to satisfy in production environments and incident-response scenarios. Volatile memory, in contrast, provides a reliable source for recovering the actual runtime state of a running application without requiring prior instrumentation. Therefore, this paper presents MEM-SBOM, the first memory forensics framework that generates SBOMs directly from the runtime state of Python applications. It recovers the modules from the interpreter's internal structures, resolves package versions, and analyzes bytecode to build dependency graphs and identify vulnerable functions. We implemented MEM-SBOM as a suite of Volatility 3 plugins and evaluated it against 51 real-world Python applications. It achieves 100% extraction accuracy, identifies Streamlit as the only application that calls the vulnerable routines of the tornado dependency, and recovers all runtime packages missed by existing SBOM tools, providing more accurate dependency graphs and better vulnerability assessment. These capabilities make MEM-SBOM a practical foundation for software supply chain security and incident response by providing a forensically sound runtime view of what is executed on a system.