Software Supply Chain Risk Precise Detection Method (SSCRPDM) Based on Dynamic Bytecode Instrumentation

With the increasing softwarization of satellite payloads and the evolution of 6G Non-Terrestrial Networks (NTNs), securing the onboard software supply chain has become critical for mission-critical space communications. Traditional static software composition analysis (SCA) often generates excessive false positives in resource-constrained satellite environments. To address this issue, this paper proposes SSCRPDM, a CVE-oriented static–dynamic risk detection method based on bytecode instrumentation. SSCRPDM parses CVE semantics to guide function-level minimal instrumentation, quantifies risk by jointly considering runtime reachability, parameter controllability, and sanitizer effectiveness, and employs deterministic proof-of-concept (PoC) verification as the primary decision mechanism, with a large language model used only for auxiliary interpretation. Specifically, SCA first identifies components containing known vulnerabilities. Runtime instrumentation then traces critical invocation paths and verifies the reachability of vulnerable functions. Finally, CVE-specific PoC payloads are executed under the current defense context to determine actual exploitability. Experimental results show that SSCRPDM effectively filters alerts caused by “zombie components” and significantly improves evaluation accuracy through exploitability verification. By bridging static version matching and dynamic threat validation, SSCRPDM substantially reduces false positives and provides a precise and proactive solution for satellite software supply chain governance.