{"id":"https://openalex.org/W4404515219","doi":"https://doi.org/10.1145/3689944.3696165","title":"On the Security Blind Spots of Software Composition Analysis","display_name":"On the Security Blind Spots of Software Composition Analysis","publication_year":2023,"publication_date":"2023-11-19","ids":{"openalex":"https://openalex.org/W4404515219","doi":"https://doi.org/10.1145/3689944.3696165"},"language":"en","primary_location":{"id":"doi:10.1145/3689944.3696165","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3689944.3696165","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3689944.3696165?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3689944.3696165?download=true","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075091948","display_name":"Jens Dietrich","orcid":"https://orcid.org/0000-0001-9019-6550"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Jens Dietrich","raw_affiliation_strings":["Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-9019-6550","affiliations":[{"raw_affiliation_string":"Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028189101","display_name":"Shawn Rasheed","orcid":"https://orcid.org/0000-0001-7683-4296"},"institutions":[{"id":"https://openalex.org/I1003870","display_name":"Universal College of Learning","ror":"https://ror.org/04k3aaz82","country_code":"NZ","type":"education","lineage":["https://openalex.org/I1003870","https://openalex.org/I4387152882"]},{"id":"https://openalex.org/I4387152882","display_name":"Te P\u016bkenga","ror":"https://ror.org/00tsqex91","country_code":null,"type":"education","lineage":["https://openalex.org/I4387152882"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Shawn Rasheed","raw_affiliation_strings":["UCOL | Te Pukenga, Palmerston North, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-7683-4296","affiliations":[{"raw_affiliation_string":"UCOL | Te Pukenga, Palmerston North, New Zealand","institution_ids":["https://openalex.org/I1003870","https://openalex.org/I4387152882"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101743962","display_name":"Alexander Jordan","orcid":"https://orcid.org/0000-0003-0763-0307"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Alexander Jordan","raw_affiliation_strings":["Oracle Labs, Vienna, Austria"],"raw_orcid":"https://orcid.org/0000-0003-0763-0307","affiliations":[{"raw_affiliation_string":"Oracle Labs, Vienna, Austria","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5109698342","display_name":"Tim White","orcid":"https://orcid.org/0000-0002-1997-0176"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Tim White","raw_affiliation_strings":["Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0002-1997-0176","affiliations":[{"raw_affiliation_string":"Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9437,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.89176969,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"77","last_page":"87"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.65622878074646},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5235269069671631},{"id":"https://openalex.org/keywords/blind-spot","display_name":"Blind spot","score":0.5151235461235046},{"id":"https://openalex.org/keywords/composition","display_name":"Composition (language)","score":0.48142048716545105},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.43714407086372375},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.29792332649230957},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.18088126182556152},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1760728657245636},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.10623079538345337}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.65622878074646},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5235269069671631},{"id":"https://openalex.org/C64731932","wikidata":"https://www.wikidata.org/wiki/Q371090","display_name":"Blind spot","level":2,"score":0.5151235461235046},{"id":"https://openalex.org/C40231798","wikidata":"https://www.wikidata.org/wiki/Q1333743","display_name":"Composition (language)","level":2,"score":0.48142048716545105},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.43714407086372375},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29792332649230957},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.18088126182556152},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1760728657245636},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.10623079538345337},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3689944.3696165","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3689944.3696165","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3689944.3696165?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3689944.3696165","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3689944.3696165","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3689944.3696165?download=true","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4404515219.pdf","grobid_xml":"https://content.openalex.org/works/W4404515219.grobid-xml"},"referenced_works_count":49,"referenced_works":["https://openalex.org/W1526301939","https://openalex.org/W1971650562","https://openalex.org/W2008626182","https://openalex.org/W2017971446","https://openalex.org/W2037797835","https://openalex.org/W2041190309","https://openalex.org/W2047764386","https://openalex.org/W2049871268","https://openalex.org/W2059390719","https://openalex.org/W2140021378","https://openalex.org/W2163048279","https://openalex.org/W2400282174","https://openalex.org/W2617348763","https://openalex.org/W2733373979","https://openalex.org/W2767231363","https://openalex.org/W2784876765","https://openalex.org/W2789570312","https://openalex.org/W2794357830","https://openalex.org/W2794456160","https://openalex.org/W2809426407","https://openalex.org/W2899324080","https://openalex.org/W2911348869","https://openalex.org/W2955008925","https://openalex.org/W2955183140","https://openalex.org/W2963321189","https://openalex.org/W2963748706","https://openalex.org/W2964232059","https://openalex.org/W2999119789","https://openalex.org/W3000438717","https://openalex.org/W3000784322","https://openalex.org/W3004749634","https://openalex.org/W3040158574","https://openalex.org/W3089825636","https://openalex.org/W3091454237","https://openalex.org/W3114916308","https://openalex.org/W3121596715","https://openalex.org/W3144273096","https://openalex.org/W3145959950","https://openalex.org/W3153398259","https://openalex.org/W3175545355","https://openalex.org/W3183115008","https://openalex.org/W3192198953","https://openalex.org/W3202468500","https://openalex.org/W4225538569","https://openalex.org/W4238124605","https://openalex.org/W4285490369","https://openalex.org/W4312247631","https://openalex.org/W4360948905","https://openalex.org/W4388857742"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W3018571661","https://openalex.org/W4247992781","https://openalex.org/W2994432938","https://openalex.org/W967069407","https://openalex.org/W2319356265","https://openalex.org/W83504689","https://openalex.org/W2280239469"],"abstract_inverted_index":{"Modern":[0],"software":[1,45],"heavily":[2],"relies":[3],"on":[4,60],"the":[5,31,35,61,64,87,90,99],"use":[6],"of":[7,33,37,41,63,89,102],"components.":[8],"Those":[9],"components":[10],"are":[11,58,83],"usually":[12],"published":[13],"in":[14],"central":[15],"repositories,":[16],"and":[17,30,43,79],"managed":[18],"by":[19],"build":[20],"systems":[21],"via":[22],"dependencies.":[23],"Due":[24],"to":[25,77,97],"issues":[26,85],"around":[27,86],"vulnerabilities,":[28],"licenses,":[29],"propagation":[32],"bugs,":[34],"study":[36],"those":[38],"dependencies":[39],"is":[40,75],"interest,":[42],"numerous":[44],"composition":[46],"analysis":[47,62],"(SCA)":[48],"tools":[49,57],"have":[50,94],"emerged":[51],"for":[52],"this":[53,74,103],"purpose.":[54],"Most":[55],"existing":[56],"based":[59],"dependency":[65],"graph":[66],"constructed":[67],"from":[68],"project":[69],"metadata":[70],"(declared":[71],"dependencies).":[72],"While":[73],"easy":[76],"implement":[78],"scales":[80],"well,":[81],"there":[82],"known":[84],"accuracy":[88],"analysis.":[91],"Recently,":[92],"improvements":[93],"been":[95],"proposed":[96],"address":[98],"low":[100],"precision":[101],"approach.":[104]},"counts_by_year":[{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}