Understanding and Enhancing Bills of Materials for Software and Artificial Intelligence Supply Chains
This program is tentative and subject to change.
Software Bills of Materials (SBOMs) and Artificial Intelligence Bills of Materials (AIBOMs) are promoted worldwide to manage the supply chain of software and Artificial Intelligence (AI) systems by providing machine-readable inventories of software and AI components. Yet, knowledge of how practitioners use SBOMs and AIBOMs—along with the challenges they encounter and the support they require—has been limited. This post-doctoral paper reports results from my PhD dissertation, which aimed to investigate the state of practice of SBOM and AIBOM and improve their tooling. The findings indicate low but growing awareness and adoption of SBOM and AIBOM, alongside substantial technical limitations in existing generators. To address these limitations, two software composition analysis tools were developed and evaluated: AIRBORNE, which enriches SBOMs by linking source code to reused Stack Overflow content, and ALOHA, which generates AIBOMs by mining information from Hugging Face. These findings provide implications for practitioners, who should integrate automated SBOM and AIBOM generation into development pipelines and procurement processes to meet standards and support risk monitoring. Future research should further improve both the generation and consumption of SBOM and AIBOM to better support their intended use cases.
This program is tentative and subject to change.
Fri 18 SepDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
14:00 - 15:30 | Session 23 - Evidence-Driven AI EngineeringDoctoral Symposium / Research Papers Track / Tool Demonstration and Data Showcase Track at Auditorium Theme: Empirical Software Engineering | ||
14:00 20mPaper | Understanding and Enhancing Bills of Materials for Software and Artificial Intelligence Supply Chains Doctoral Symposium Sabato Nocera University of Salerno | ||
14:20 20mPaper | Sentinel: Field-Sensitive Taint Analysis for Detecting Java Deserialization Gadget Chains Research Papers Track Yanrong Lu Civil aviation of university of china, Dongsheng Li Civil Aviation University of China, Siqi Ma the University of Queensland, Wencheng Yang University of Southern Queensland} \ Queensland | ||
14:40 20mPaper | Unveiling the Ownership: An Empirical Study of Android App Associations via SDK IDs Research Papers Track Qinsheng Hou Shanghai Jiao Tong University, Wenrui Diao Shandong University, Chaoshun Zuo Ohio State University, Qingchuan Zhao City University of Hong Kong, Lingyun Ying QI-ANXIN Technology Research Institute, Yacong Gu Tsinghua University-QI-ANXIN Group JCN, Libo Chen Shanghai Jiao Tong University, Shanqing Guo Shandong University, Haixin Duan Institute for Network Science and Cyberspace, Tsinghua University; Qi An Xin Group Corp., Zhi Xue Shanghai Jiao Tong University | ||
15:00 10mShort-paper | VULTRITION: Nutrition Labels for Vulnerability Datasets Tool Demonstration and Data Showcase Track Torge Hinrichs Technische Universität Hamburg, Emanuele Iannone Technische Universität Hamburg, Riccardo Scandariato Hamburg University of Technology Pre-print Media Attached | ||