An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead

Xia, Boming; Bi, Tingting; Xing, Zhenchang; Lu, Qinghua; Zhu, Liming

doi:10.1109/icse48619.2023.00219

Cited by 31 publications

(1 citation statement)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the rapid developments of the Internet of things (IoT), it has become increasingly crucial to maintain reliable IoT software systems in real‐world scenarios. However, there is consequently emerging malicious software (Malware) targeting the smart devices in the IoT systems [1, 2]. Generally, these devices are integrated with various specially designed software for health monitoring and intelligent assistance, and such supporting software is commonly connected to a cloud centre for personalised decision support.…”

Section: Introductionmentioning

confidence: 99%

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

et al. 2023

View full text Add to dashboard Cite

Recent developments in the field of Internet of things (IoT) have aroused growing attention to the security of smart devices. Specifically, there is an increasing number of malicious software (Malware) on IoT systems. Nowadays, researchers have made many efforts concerning supervised machine learning methods to identify malicious attacks. High-quality labels are of great importance for supervised machine learning, but noises widely exist due to the non-deterministic production environment. Therefore, learning from noisy labels is significant for machine learning-enabled Malware identification. In this study, motivated by the symmetric cross entropy with satisfactory noise robustness, the authors propose a robust Malware identification method using temporal convolutional network (TCN). Moreover, word embedding techniques are generally utilised to understand the contextual relationship between the input operation code (opcode) and application programming interface function names. Here, considering the numerous unlabelled samples in real-world intelligent environments, the authors pre-train the TCN model on an unlabelled set using a word embedding method, that is, Word2Vec. In the experiments, the proposed method is compared with several traditional statistical methods and more recent neural networks on a synthetic Malware dataset and a realworld dataset. The performance comparisons demonstrate the better performance and noise robustness of their proposed method, especially that the proposed method can yield the best identification accuracy of 98.75% in real-world scenarios.

show abstract

Section: Introductionmentioning

confidence: 99%

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

et al. 2023

View full text Add to dashboard Cite

show abstract

A blockchain‐based and microservices‐architected software composition analysis system

Zhou,

Xu,

et al. 2024

J Software Evolu Process

View full text Add to dashboard Cite

Abstract“Shift To Left” is the cornerstone of the successful implementation of DevSecOps. By testing projects for vulnerabilities in the early stages of development, teams can save overall costs before security issues reach the build phase. As one of the popular practices in “Shift To Left,” the Software Composition Analysis (SCA) system aims to leverage the Software Bill of Materials (SBOM) to enhance software supply chain security. However, the SBOM lacks mature generation and distribution mechanisms, requiring incentive measures to drive industry consensus. Additionally, the data and tools associated with the SBOM lack effective record‐keeping and monitoring, making it challenging to ensure data integrity and tool security. Traditional SCA systems treat SBOM as a regular data format for external service provision, yet fail to solve problems such as lack of shared platforms, inability to guarantee data integrity and tool security, as well as issues with poor interoperation compatibility. This paper introduces blockchain technology into the SCA system, utilizing smart contracts to provide core SBOM tool services and microservices to improve the operational efficiency of smart contract deployment and maintenance. The proposed SCA system effectively provides a shared platform for SBOM with reliable data integrity, guaranteed tool security, and good interoperability.

show abstract

Software Bill of Materials (SBOM) Approach to IoT Security Vulnerability Assessment

Bonacci,

Martin

2024

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead

Cited by 31 publications

References 27 publications

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

A blockchain‐based and microservices‐architected software composition analysis system

Software Bill of Materials (SBOM) Approach to IoT Security Vulnerability Assessment

Contact Info

Product

Resources

About