Software Composition Analysis (SCA) identifies reused third-party libraries (TPLs) and their dependencies, forming the basis of Software Bills of Materials (SBOMs) for securing software supply chain. Current C/C++ SCA techniques extract code features and match them against a TPL feature database. However, detection recall is limited by feature database coverage, and two key challenges remain: (1) \textbf{\emph{Coverage-Precision Trade-off}}: Feature databases built from a single repository (e.g., \emph{GitHub}) often yield high false negatives, as C/C++ TPLs are inherently distributed across diverse hosting platforms (e.g., \emph{Debian}, \emph{ArchLinux}, and \emph{Xrepo}), each offering partially overlapping yet distinct sets of TPLs. Although a multi-repository feature database improves TPL coverage, it inevitably introduces numerous \emph{shared functions} (e.g., cross-TPL code clones) that map to a broader set of candidate origins. When coupled with the limitations of existing SCA techniques in tracing provenance, this ambiguity further increases false positives. (2) \textbf{\emph{Neglected Dependency Context:}} Existing SCA techniques primarily focus on detecting reused TPLs but often overlook their inter-dependencies. However, license compatibility constraints are inherently determined by directed dependency relationships among TPLs.

DeepSCA addresses \textbf{\emph{Challenge 1}} by constructing a feature database with 66,143,596 functions extracted from 33,100 C/C++ TPLs, covering nine mainstream hosting repositories. To reduce false positives from \emph{shared functions}, DeepSCA groups TPLs with shared code, and uses uniqueness scores to trace functions to their origins—ensuring high precision without sacrificing recall. To overcome \textbf{\emph{Challenge 2}}, DeepSCA generates the dependency graph from the detected TPLs. it resolves filename ambiguity by simulating compiler header search paths and mitigates symbol ambiguity via namespace-aware resolution, enabling accurate file-level dependency mapping to TPLs. Evaluated on a ground-truth dataset of 335 OpenHarmony projects (10,583 TPLs, 64,200 dependencies), DeepSCA achieves 85.6% precision and 87.3% recall for TPL detection, outperforming state-of-the-art tools (e.g., 16.8% precision and 21.1% recall improvement over TPLite). Its dependency graphs reach 91.8% precision, surpassing Cneps by 11.3%. Moreover, the dependency graph generated by DeepSCA uncovers previously hidden combinations of license incompatibility issues in real-world projects.