The extensive reuse of open-source software (OSS) accelerates development. However, it also creates increasingly complex software supply chains (SSCs) and intensifies the attacker-defender asymmetry, making attacks "low-cost, high-impact, and hard-to-detect." Software Bill of Materials (SBOMs) and Software Composition Analysis (SCA) are widely used for SSC analysis, but both have clear limitations. SBOMs frequently lack vulnerability information, while SCA tools are typically limited to specific ecosystems. To address these limitations, we first construct a multi-source software supply chain knowledge graph (SSCKG) that unifies heterogeneous information and supports continuous evolution through automated updates. Building on this foundation, we propose S2CAgent, a neural-symbolic large language model (LLM) agent framework for SSC analysis. S2CAgent supports natural language questions by inducing symbolic reasoning rules from the SSCKG. These rules align complex questions with underlying graph semantics and multi-hop reasoning patterns. Furthermore, the agent leverages structured evidence from the SSCKG and unstructured web knowledge, thereby mitigating LLM hallucinations and alleviating knowledge incompleteness. In addition, it incorporates a self-learning mechanism that synthesizes and refines tool-augmented trajectories to improve future reasoning. We evaluate S2CAgent on a newly constructed cross-ecosystem benchmark that includes three core tasks: vulnerability impact assessment, software dependency analysis, and license compliance checking. Experimental results show that S2CAgent outperforms baselines across multiple metrics and remains stable under complex multi-hop reasoning. In particular, S2CAgent has been deployed at a leading ICT corporation, where it effectively handles complex real-world analysis cases, further demonstrating its practical utility.

@inproceedings{paperbot12620,
  title = {S2CAgent: A Self-Learning Agent Knowledge Graph Framework for Software Supply Chain Analysis},
  author = {Youfei Huang and Zhong Li and Minxue Pan and Xuandong Li},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3837513}
}