Search papers, labs, and topics across Lattice.
This paper introduces MEM-SBOM, a novel memory forensics framework that generates Software Bills of Materials (SBOMs) directly from the runtime state of Python applications, overcoming the limitations of traditional SBOM generation methods that rely on static metadata or filesystem artifacts. By leveraging volatile memory, MEM-SBOM achieves 100% extraction accuracy and successfully identifies all runtime packages that conventional tools overlook, including specific vulnerabilities in the tornado dependency used by Streamlit. The framework's ability to provide accurate dependency graphs and vulnerability assessments positions it as a critical tool for enhancing software supply chain security and incident response efforts.
MEM-SBOM reveals that existing SBOM tools miss critical runtime dependencies, achieving perfect extraction accuracy and exposing vulnerabilities in real-world applications.
Modern software development relies heavily on third-party components from public repositories, expanding the software supply chain attack surface. In response to these growing risks, federal initiatives have advanced the Software Bill of Materials (SBOM) as a standardized mechanism for improving transparency by describing software components, dependencies, and their relationships. However, SBOMs built from metadata or filesystem artifacts fail to capture the components loaded and executed at runtime, especially in dynamic ecosystems such as Python. Moreover, generating runtime SBOMs through instrumentation requires monitoring to be deployed in advance and the system to remain observable throughout execution. Such conditions are difficult to satisfy in production environments and incident-response scenarios. Volatile memory, in contrast, provides a reliable source for recovering the actual runtime state of a running application without requiring prior instrumentation. Therefore, this paper presents MEM-SBOM, the first memory forensics framework that generates SBOMs directly from the runtime state of Python applications. It recovers the modules from the interpreter's internal structures, resolves package versions, and analyzes bytecode to build dependency graphs and identify vulnerable functions. We implemented MEM-SBOM as a suite of Volatility 3 plugins and evaluated it against 51 real-world Python applications. It achieves 100% extraction accuracy, identifies Streamlit as the only application that calls the vulnerable routines of the tornado dependency, and recovers all runtime packages missed by existing SBOM tools, providing more accurate dependency graphs and better vulnerability assessment. These capabilities make MEM-SBOM a practical foundation for software supply chain security and incident response by providing a forensically sound runtime view of what is executed on a system.
