{"id":"https://openalex.org/W7164828188","doi":"https://doi.org/10.48550/arxiv.2606.13966","title":"Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations","display_name":"Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations","publication_year":2026,"publication_date":"2026-06-11","ids":{"openalex":"https://openalex.org/W7164828188","doi":"https://doi.org/10.48550/arxiv.2606.13966"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.13966","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.13966","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.13966","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5011867274","display_name":"Abhishek Reddypalle","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Reddypalle, Abhishek","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5116817509","display_name":"Dennis Roellke","orcid":"https://orcid.org/0009-0008-3872-633X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Roellke, Dennis","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138629709","display_name":"Santiago Torres-Arias","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Torres-Arias, Santiago","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.2808000147342682,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.2808000147342682,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.09839999675750732,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.09059999883174896,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.6262999773025513},{"id":"https://openalex.org/keywords/artifact","display_name":"Artifact (error)","score":0.5593000054359436},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.5202999711036682},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.4602000117301941},{"id":"https://openalex.org/keywords/disjoint-sets","display_name":"Disjoint sets","score":0.45170000195503235},{"id":"https://openalex.org/keywords/plug-in","display_name":"Plug-in","score":0.44780001044273376},{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.4307999908924103},{"id":"https://openalex.org/keywords/software-evolution","display_name":"Software evolution","score":0.40950000286102295},{"id":"https://openalex.org/keywords/container","display_name":"Container (type theory)","score":0.3959999978542328}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7416999936103821},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.6262999773025513},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.5593000054359436},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5202999711036682},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4602000117301941},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.45329999923706055},{"id":"https://openalex.org/C45340560","wikidata":"https://www.wikidata.org/wiki/Q215382","display_name":"Disjoint sets","level":2,"score":0.45170000195503235},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.44780001044273376},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.4307999908924103},{"id":"https://openalex.org/C202105479","wikidata":"https://www.wikidata.org/wiki/Q265013","display_name":"Software evolution","level":5,"score":0.40950000286102295},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.3959999978542328},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.39160001277923584},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.35690000653266907},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3513999879360199},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.337799996137619},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.33230000734329224},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31619998812675476},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.29600000381469727},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.28349998593330383},{"id":"https://openalex.org/C97250363","wikidata":"https://www.wikidata.org/wiki/Q235557","display_name":"File format","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C174683762","wikidata":"https://www.wikidata.org/wiki/Q609588","display_name":"Component-based software engineering","level":4,"score":0.27880001068115234},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.27799999713897705},{"id":"https://openalex.org/C82214349","wikidata":"https://www.wikidata.org/wiki/Q657339","display_name":"Software metric","level":5,"score":0.2775999903678894},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.27300000190734863},{"id":"https://openalex.org/C2781009160","wikidata":"https://www.wikidata.org/wiki/Q735604","display_name":"AspectJ","level":4,"score":0.26440000534057617},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.26249998807907104},{"id":"https://openalex.org/C4379982","wikidata":"https://www.wikidata.org/wiki/Q1273511","display_name":"Software visualization","level":5,"score":0.26179999113082886},{"id":"https://openalex.org/C153876917","wikidata":"https://www.wikidata.org/wiki/Q899704","display_name":"Traceability","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.2590999901294708},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2547000050544739}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.13966","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.13966","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.13966","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.13966","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"software":[1,18,186],"supply":[2],"chains":[3],"have":[4,33],"evolved":[5],"into":[6],"vast,":[7],"heterogeneous":[8],"networks":[9],"where":[10,164],"transparency":[11],"-":[12,20],"the":[13,36,84,135,149,202],"granular":[14],"understanding":[15],"of":[16,30,86,115,151,205],"all":[17],"components":[19],"is":[21,54,67,213],"now":[22],"a":[23,47,71,104,128,140,162],"critical":[24],"security":[25],"requirement.":[26],"While":[27],"Software":[28,78],"Bills":[29],"Materials":[31],"(SBOMs)":[32],"emerged":[34],"as":[35,77,148],"primary":[37],"mechanism":[38],"for":[39,97,143],"this":[40,65],"transparency,":[41],"current":[42],"industry":[43],"practices":[44],"rely":[45],"on":[46],"metadata-centric":[48],"paradigm":[49],"that":[50,64,94,182,211],"assumes":[51],"an":[52,91,176],"artifact":[53,144],"defined":[55],"solely":[56],"by":[57,98,192],"its":[58,99],"package":[59],"manager":[60],"declarations.":[61],"We":[62,102,158,180],"posit":[63],"assumption":[66],"fundamentally":[68],"flawed,":[69],"creating":[70],"systemic":[72],"visibility":[73],"gap":[74],"we":[75,138],"define":[76],"Dark":[79],"Matter":[80],"(SDM).":[81],"SDM":[82,147,183,212],"represents":[83],"set":[85],"security-critical":[87],"files":[88,153],"present":[89],"in":[90],"artifact's":[92,177],"filesystem":[93],"are":[95],"unaccounted":[96],"associated":[100],"metadata.":[101],"implement":[103],"reference":[105],"tool,":[106],"DARKFILES,":[107],"and":[108,125,127,200,221],"use":[109],"it":[110],"to":[111,175,188],"analyze":[112],"four":[113],"ecosystems":[114],"disjoint":[116],"nature:":[117],"DockerHub,":[118],"Maven":[119],"Central,":[120],"plugin/extension":[121],"marketplaces":[122],"(Jenkins":[123],"plugins":[124],"OpenVSX),":[126],"real-world":[129],"enterprise":[130],"environment.":[131],"Our":[132],"research":[133],"makes":[134],"following":[136],"contributions:":[137],"introduce":[139,159],"general-purpose":[141],"metric":[142],"fidelity":[145],"calculating":[146],"ratio":[150],"untracked":[152,194],"per":[154],"total":[155],"file":[156],"count.":[157],"Packaging":[160],"Lag,":[161],"phenomenon":[163],"official":[165],"metadata":[166],"remains":[167],"out-of-date":[168],"across":[169],"multiple":[170],"versions":[171],"before":[172],"catching":[173],"up":[174],"actual":[178],"content.":[179],"demonstrate":[181],"exposes":[184],"vulnerable":[185],"invisible":[187],"SBOM-driven":[189],"pipelines":[190],"both":[191],"cross-referencing":[193],"packages":[195],"against":[196],"known":[197],"CVE":[198],"databases":[199],"through":[201],"direct":[203],"discovery":[204],"three":[206],"confirmed":[207],"high-severity":[208],"CVEs,":[209],"showing":[210],"highly":[214],"correlated":[215],"with":[216],"sensitive":[217],"information":[218],"including":[219],"secrets":[220],"cryptographic":[222],"keys.":[223]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-16T00:00:00"}