← Back to project catalogue
GP-CY-1G53IQ8CybersecurityReady

Firmware SBOM and Component Exposure Analyser

An offline Python analyser that identifies components in extracted Linux firmware, creates a CycloneDX SBOM, and reviews possible exposure without executing the firmware.

Firmware SBOM and Component Exposure Analyser project visual
GP-CY-1G53IQ8 · Cybersecurity
  • Python
  • CycloneDX 1.7
  • OSV schema
  • Matplotlib

Project definition

Problem statement

Linux-based firmware can contain packages, libraries, tools, configuration, and vendor code without the original build records being available to an analyst.

The project identifies observable components and keeps the evidence behind every result. It does not treat a filename, package match, or severity score as proof that a device is exploitable.

Project objectives

  • Inspect supported firmware directories, tar archives, and zip archives without executing their contents.
  • Identify components from dpkg, apk, opkg, filenames, and selected binary version strings.
  • Record the path, source, detail, and confidence behind each component identity.
  • Generate a CycloneDX 1.7 SBOM with package URLs and generation context.
  • Match prepared OSV-style advisories and explain each triage priority.
  • Evaluate identity quality, archive safety, SBOM fields, and scaling on a reproducible corpus.

Project structure

Project components

01

Safety gate

Checks archive paths, links, file counts, and expanded size before analysis.

02

Evidence collection

Reads common Linux package records and selected binary or filename evidence.

03

Identity resolver

Reconciles matching evidence, retains conflicts, and records confidence and package URLs.

04

SBOM generator

Produces CycloneDX 1.7 JSON with firmware metadata and component evidence.

05

Exposure review

Matches a prepared offline advisory corpus and records status, priority, and rationale.

06

Experiment suite

Compares the method with a naive baseline and tests safety, completeness, and scaling.

Methodology

Project workflow

  1. 01
    Prepare input

    Select an authorised extracted firmware root or supported archive.

  2. 02
    Apply safety checks

    Reject unsafe paths, links, device nodes, oversized expansion, and unsupported archives.

  3. 03
    Collect evidence

    Read package records and selected file or binary clues without running target code.

  4. 04
    Build inventory

    Reconcile component name and version evidence and calculate identity confidence.

  5. 05
    Write results

    Create the component inventory, CycloneDX SBOM, exposure review, redacted secret indicators, and summary.

Demonstration scenario

The analyser processes a synthetic router firmware root, identifies three package-backed components, writes a CycloneDX 1.7 SBOM, records two prepared potential exposures with evidence, and reports one redacted credential indicator without executing any firmware file.

Engineering

Tools and method

Python package
Small typed modules for archive safety, parsing, inventory, version handling, SBOM output, exposure matching, and redaction.
Prepared data
Eight synthetic firmware roots, independent ground truth, and six synthetic OSV-style advisory records.
Reproducible evidence
Retained JSON results, eight generated figures, a static dashboard, and scripts for every experiment.
Quality controls
35 tests, Ruff checks, dependency audit, repository validation, and document accessibility audits.

Testing

Evaluation

Evaluation measures

  • Precision, recall, and F1 for exact component name and version pairs
  • Comparison with a naive string-matching baseline
  • Correct archive-policy decisions across safe and unsafe cases
  • Agreement between prepared exposure ground truth and analyser output
  • CycloneDX document and component-field completeness
  • Median inventory time from 25 to 1,600 small files

Project boundaries

  • Only firmware the operator is authorised to inspect should be used.
  • The analyser does not execute firmware, emulate devices, or probe live systems.
  • The included fixtures and advisory identifiers are synthetic.
  • A component match does not prove vulnerable code is reachable or exploitable.
  • The prepared advisory file is not a live vulnerability service.
  • No information is collected.

Included

  1. 01Complete Python source code
  2. 02Eight synthetic firmware fixtures with ground truth
  3. 03CycloneDX 1.7 SBOM and exposure outputs
  4. 04Prepared offline advisory data
  5. 0597-page project documentation in PDF and editable Word formats
  6. 0620-page setup and usage guide in PDF and editable Word formats
  7. 0735 automated tests, retained results, and eight figures

Project record

No information is collected on this page.

Permanent project ID
GP-CY-1G53IQ8
Catalogued
21 Aug 2026
Completed
24 Aug 2026
Verified
24 Aug 2026
Demonstration
Included in repository

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.