DeepSCA: Dependency-Aware Software Composition Analysis for C/C++ Based on a Curated Code Feature Database

Software Composition Analysis (SCA) identifies reused third-party libraries (TPLs) and their dependencies, forming the basis of Software Bills of Materials (SBOMs) for securing software supply chain. Current C/C++ SCA techniques extract code features and match them against a TPL feature database. However, detection recall is limited by feature database coverage, and two key challenges remain: (1) Coverage-Precision Trade-off : Feature databases built from a single repository (e.g., GitHub ) often yield high false negatives, as C/C++ TPLs are inherently distributed across diverse hosting platforms (e.g., Debian , ArchLinux , and Xrepo ), each offering partially overlapping yet distinct sets of TPLs. Although a multi-repository feature database improves TPL coverage, it inevitably introduces numerous shared functions (e.g., cross-TPL code clones) that map to a broader set of candidate origins. When coupled with the limitations of existing SCA techniques in tracing provenance, this ambiguity further increases false positives. (2) Neglected Dependency Context: Existing SCA techniques primarily focus on detecting reused TPLs but often overlook their inter-dependencies. However, license compatibility constraints are inherently determined by directed dependency relationships among TPLs. DeepSCA addresses Challenge 1 by constructing a feature database with 66,143,596 functions extracted from 33,100 C/C++ TPLs, covering nine mainstream hosting repositories. To reduce false positives from shared functions , DeepSCA groups TPLs with shared code, and uses distinctiveness scores to trace functions to their origins—ensuring high precision without sacrificing recall. To overcome Challenge 2 , DeepSCA generates the dependency graph from the detected TPLs. it resolves filename ambiguity by simulating compiler header search paths and mitigates symbol ambiguity via namespace-aware resolution, enabling accurate file-level dependency mapping to TPLs. Evaluated on a ground-truth dataset of 335 OpenHarmony projects (10,583 TPLs, 64,200 dependencies), DeepSCA achieves 85.6% precision and 87.3% recall for TPL detection, outperforming state-of-the-art tools (e.g., 16.8% precision and 21.1% recall improvement over TPLite). Its dependency graphs reach 91.8% precision, surpassing Cneps by 11.3%. Moreover, the dependency graph generated by DeepSCA uncovers previously hidden combinations of license incompatibility issues in real-world projects.