# Chain-of-Experts (CoE): Reverse Engineering Software Bills of Materials for JavaScript Application Bundles through Code Clone Search

**Authors:** Leo Song, Steven H. H. Ding, Yuan Tian, Li Tao Li, Philippe Charland, Andrew Walenstein  
**arXiv:** [2408.16198](https://arxiv.org/abs/2408.16198)  
**Date:** 2024-08-29  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2408.16198v1/

## Key points

- A Software Bill of Materials (SBoM) is crucial for listing all components, libraries, and modules in a software artifact to ensure traceability across the supply chain.
- Reverse-engineering JavaScript application bundles to generate an SBoM is essential for maintaining integrity, security, and compliance of software releases.
- Chain-of-Experts (CoE) is introduced as a multi-task deep learning model to address challenges like nested code scopes, extremely long sequences, and vast retrieval spaces in SBoM generation for JavaScript application bundles.
- CoE offers competitive outcomes with reduced training and inference time compared to individual task-specific solutions when evaluated using 500 web application bundles with over 66,000 dependencies.
- Advancements in deep learning-based clone detection approaches such as Cclearner and Deepsim are highlighted for their relevance in software functional clone detection.

## Summary

, , , , 

A Software Bill of Materials (SBoM) is a crucial inventory that lists all components, libraries, and modules within a software artifact, ensuring traceability across the software supply chain. The surge in the use of JavaScript in software development has led to increased vulnerabilities and security threats due to its dynamic nature and seamless integration within the supply chain. JavaScript application bundles are optimized assemblies of code for deployment purposes. Reverse-engineering these bundles to generate an SBoM is essential for maintaining the integrity, security, and compliance of software releases, even without access to original dependency graphs. This paper delves into the pioneering study on SBoM generation for JavaScript application bundles, pinpointing three main challenges: nested code scopes, extremely long sequences, and vast retrieval spaces. To tackle these hurdles effectively, Chain-of-Experts (CoE) is introduced as a multi-task deep learning model designed to facilitate SBoM generation through tasks like code segmentation, classification, and clone retrieval. CoE's performance is evaluated against individual task-specific solutions using 500 web application bundles with over 66,000 dependencies. Results indicate that CoE offers competitive outcomes with reduced training and inference time compared to combined individual solutions. Furthermore, references from related studies on structured summarization techniques like text segmentation and labeling as a generation task are cited. Additionally, advancements in deep learning-based clone detection approaches such as Cclearner and Deepsim are highlighted for their relevance in software functional clone detection. The paper also mentions neural detection methods for semantic code clones via tree-based convolution and fusion learning techniques for functional code clone detection with syntax and semantics fusion. The unified structure of CoE presents an efficient solution for generating SBoMs from real-world JavaScript application bundles by addressing key challenges effectively. This comprehensive approach aims to enhance the efficiency of SBoM tasks while providing scalability and end-to-end solutions for software supply chain management.