UniBOM -- A Unified SBOM Analysis and Visualisation Tool for IoT Systems and Beyond
Vadim Safronov, Ionut Bostan, Nicholas Allott, Andrew Martin
TL;DR
UniBOM tackles the security of complex IoT software stacks by unifying binary, filesystem, and source-code analysis into an end-to-end SBOM workflow. It integrates Binwalk, Syft, CCScanner, and Grype, adds AI-driven memory-safety vulnerability classification, and provides a web GUI for visualizing vulnerability histories and risk. Through large-scale firmware and OS-code evaluations, UniBOM demonstrates superior vulnerability detection compared with existing SBOM tools, particularly for non-package-managed C/C++ dependencies. The work advances SBOM-driven security for IoT and broader software ecosystems and is released as open source for integration into real-world workflows. Future directions include AIBOM integration and enhanced operational deployment within security pipelines.
Abstract
Modern networked systems rely on complex software stacks, which often conceal vulnerabilities arising from intricate interdependencies. A Software Bill of Materials (SBOM) is effective for identifying dependencies and mitigating security risks. However, existing SBOM solutions lack precision, particularly in binary analysis and non-package-managed languages like C/C++. This paper introduces UniBOM, an advanced tool for SBOM generation, analysis, and visualisation, designed to enhance the security accountability of networked systems. UniBOM integrates binary, filesystem, and source code analysis, enabling fine-grained vulnerability detection and risk management. Key features include historical CPE tracking, AI-based vulnerability classification by severity and memory safety, and support for non-package-managed C/C++ dependencies. UniBOM's effectiveness is demonstrated through a comparative vulnerability analysis of 258 wireless router firmware binaries and the source code of four popular IoT operating systems, highlighting its superior detection capabilities compared to other widely used SBOM generation and analysis tools. Packaged for open-source distribution, UniBOM offers an end-to-end unified analysis and visualisation solution, advancing SBOM-driven security management for dependable networked systems and broader software.