Post Incident Runtime SBOM Generation from Python Memory
summary
A new memory-forensic pipeline named MemSBOM traverses Python interpreters, module registries, garbage-collector lists, arena pools and heap objects to recover loaded modules, parse bytecode to build dependency graphs, resolve versions from in-memory attributes and PyPI normalization, and emit a CycloneDX-compliant SBOM. Evaluated on 51 real-world apps and compared to eight SBOM tools it finds five install/version mismatches and a Tornado/Streamlit case that cuts false-positive CVE noise by 80.3%, supports Python up to 3.14/3.15.
AI-written summary · about
chapters (7)
- 0:00Runtime SBOM generation intro
- 1:52Why runtime SBOM matters
- 7:53SBOM from Python memory
- 12:11Dynamic Python modules challenges
- 19:18MemSBOM tool design
- 28:10Key takeaways and future work
- 29:36Q&A on Python versions
related talks
32mSBOMit: Making SBOMs Accurate With Attestations
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
41mYour SBOM Is Lying To You – Let’s Make It Honest
34mSBOMs: zero to hero in 25 mins!
43mA radiography of a SBOM vulnerability scanner
57mCode Genome - Fingerprinting Code to Build Trustworthy SBOMs
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
47mThe Missing Link - How we collect and leverage SBOMs