SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Software composition analysis</title>

</head>

Software composition analysis

</h1>

</header>

Software composition analysis (SCA) is a practice in the fields of Information technology and software engineering for analyzing custom-built software applications to detect embedded open-source software and detect if they are up-to-date, contain security flaws, or have licensing requirements.<a href="#cite_note-1">[1]</a>

<div class="mw-heading mw-heading2"><h2 id="Background">Background</h2></div>

It is a common software engineering practice to develop software by using different components.<a href="#cite_note-2">[2]</a> Using <a href="Component-based_software_engineering#Software_component" title="Component-based software engineering">software components</a> segments the complexity of larger elements into smaller pieces of code and increases flexibility by enabling easier reuse of components to address new requirements.<a href="#cite_note-3">[3]</a> The practice has widely expanded since the late 1990s with the popularization of <a href="Open-source_software" title="Open-source software">open-source software</a> (OSS) to help speed up the software development process and reduce time to market.<a href="#cite_note-4">[4]</a>

However, using <a href="Open-source_software" title="Open-source software">open-source software</a> introduces many risks for the software applications being developed. These risks can be organized into 5 categories:<a href="#cite_note-5">[5]</a>

<ul><li>OSS Version Control: risks of changes introduced by new versions</li>

<li>Security: risks of vulnerabilities in components - <a href="Common_Vulnerabilities_and_Exposures" title="Common Vulnerabilities and Exposures">Common Vulnerabilities & Exposures</a> (or CVEs)</li>

<li>License: risks of <a href="Intellectual_property" title="Intellectual property">Intellectual property</a> (IP) legal requirements</li>

<li>Development: risks of compatibility between existing codebase and <a href="Open-source_software" title="Open-source software">open-source software</a></li>

<li>Support: risk of poor documentation and <a href="Obsolescence" title="Obsolescence">Obsolete software components</a></li></ul>

Shortly after the foundation of the <a href="Open_Source_Initiative" title="Open Source Initiative">Open Source Initiative</a> in February 1998,<a href="#cite_note-6">[6]</a> the risks associated with OSS were raised<a href="#cite_note-7">[7]</a> and organizations tried to manage this using spreadsheets and documents to track all the open source components used by their developers.<a href="#cite_note-8">[8]</a>

For organizations using open-source components extensively, there was a need to help automate the analysis and management of open source risk. This resulted in a new category of software products called Software Composition Analysis (SCA) which helps organizations manage open source risk.

SCA strives to detect all the 3rd party components in use within a software application to help reduce risks associated with security vulnerabilities, IP licensing requirements, and obsolescence of components being used.

<div class="mw-heading mw-heading2"><h2 id="Principle_of_operation">Principle of operation</h2></div>

SCA products typically work as follows:<a href="#cite_note-9">[9]</a>

<ul><li>An engine scans the software source code, and the associated artifacts used to compile a software application.</li>

<li>The engine identifies the OSS components and their versions and usually stores this information in a database creating a catalog of OSS in use in the scanned application.</li>

<li>This catalog is then compared to databases referencing known security vulnerabilities for each component, the licensing requirements for using the component, and the historical versions of the component. For security vulnerability detection, this comparison is typically made against known security vulnerabilities (CVEs) that are tracked in the <a href="National_Vulnerability_Database" title="National Vulnerability Database">National Vulnerability Database</a> (NVD). Some products use an additional proprietary database of vulnerabilities. For <a href="Legal_governance%2C_risk_management%2C_and_compliance#Legal_compliance" title="Legal governance, risk management, and compliance">IP / Legal Compliance</a>, SCA products will extract and evaluate the type of licensing used for the OSS component.<a href="#cite_note-10">[10]</a> Versions of components are extracted from popular open source repositories such as <a href="GitHub" title="GitHub">GitHub</a>, <a href="Apache_Maven" title="Apache Maven">Maven</a>, <a href="Python_Package_Index" title="Python Package Index">PyPi</a>, <a href="NuGet" title="NuGet">NuGet</a>, and many others.</li>

<li>The results are then made available to end users using different digital formats. The content and format depend on the SCA product and may include guidance to evaluate and interpret the risk, and recommendations especially when it concerns the legal requirements of open source components such as <a href="Copyleft#Strong_and_weak_copyleft" title="Copyleft">strong or weak copyleft</a> licensing. The output may also contain a <a href="Software_supply_chain" title="Software supply chain">Software Bill of Materials</a> (SBOM) detailing all the open source components and associated attributes used in a software application<a href="#cite_note-11">[11]</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Usage">Usage</h2></div>

As SCA impacts different functions in organizations, different teams may use the data depending on the organization's corporation size and structure. The IT department will often use SCA for implementing and operationalizing the technology with common stakeholders including the chief information officer (CIO), the Chief Technology Officer (CTO), and the Chief Enterprise Architects (EA).<a href="#cite_note-SBM_1-12">[12]</a> Security and license data are often used by roles such as Chief Information Security Officers (CISO) for security risks, and Chief IP / Compliance officer for Intellectual Property risk management.<a href="#cite_note-13">[13]</a>

Depending on the SCA product capabilities, it can be implemented directly within a developer's <a href="Integrated_development_environment" title="Integrated development environment">Integrated Development Environment</a> (IDE) who uses and integrates OSS components, or it can be implemented as a dedicated step in the <a href="Software_quality_control" title="Software quality control">software quality control</a> process.<a href="#cite_note-14">[14]</a><a href="#cite_note-15">[15]</a>

SCA products, and particularly their capacity to generate an SBOM is required in some countries such as the United States to enforce the security of software delivered to one of their agencies by a vendor.<a href="#cite_note-SB_1-16">[16]</a>

Another common use case for SCA is for Technology <a href="Due_diligence" title="Due diligence">Due diligence</a>. Prior to a <a href="Mergers_and_acquisitions" title="Mergers and acquisitions">Merger & Acquisition</a> (M&A) transaction, <a href="Independent_advisory_firm" title="Independent advisory firm">Advisory firms</a> review the risks associated with the software of the target firm.<a href="#cite_note-17">[17]</a>

<div class="mw-heading mw-heading2"><h2 id="Strengths">Strengths</h2></div>

The automatic nature of SCA products is their primary strength. Developers don't have to manually do an extra work when using and integrating OSS components.<a href="#cite_note-18">[18]</a> The automation also applies to indirect references to other OSS components within code and artifacts.<a href="#cite_note-19">[19]</a>

<div class="mw-heading mw-heading2"><h2 id="Weaknesses">Weaknesses</h2></div>

Conversely, some key weaknesses of current SCA products may include:

<ul><li>Complex and labor-intensive deployment that can take months to get fully operational <a href="#cite_note-20">[20]</a></li>

<li>Each product uses its own proprietary database of OSS components that can vary dramatically in terms of size and coverage <a href="#cite_note-21">[21]</a></li>

<li>Limiting vulnerability data to reporting only on vulnerabilities officially reported in the NVD (which can be months after the vulnerability was originally discovered)<a href="#cite_note-22">[22]</a></li>

<li>Lack of automated guidance on actions to take based on SCA reports and data<a href="#cite_note-23">[23]</a></li>

<li>Lack of guidance on the legal requirements of OSS licenses that are detected <a href="#cite_note-24">[24]</a></li></ul>

<ul><li><a href="Security_testing" title="Security testing">Security testing</a></li>

<li><a href="Open-source_software" title="Open-source software">Open-source software</a></li>

<li><a href="Common_Vulnerabilities_and_Exposures" title="Common Vulnerabilities and Exposures">Common Vulnerabilities and Exposures</a></li>

<li><a href="Open-source_license" title="Open-source license">Open-source license</a></li>

<li><a href="Software_intelligence" title="Software intelligence">Software intelligence</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFPranaSharmaSharFoo2021" class="citation journal cs1">Prana, Gede Artha Azriadi; Sharma, Abhishek; Shar, Lwin Khin; Foo, Darius; Santosa, Andrew E; Sharma, Asankhaya; Lo, David (July 2021). <a rel="nofollow" class="external text" href="https://ink.library.smu.edu.sg/sis_research/6048">"Out of sight, out of mind? How vulnerable dependencies affect open-source projects"</a>. Empirical Software Engineering. 26 (4). Springer: 1–34. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2Fs10664-021-09959-3">10.1007/s10664-021-09959-3</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:197679660">197679660</a>.</cite>

</li>

<cite id="CITEREFNierstraszMeijler1995" class="citation journal cs1">Nierstrasz, Oscar; Meijler, Theo Dirk (1995). <a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F210376.210389">"Research directions in software composition"</a>. ACM Computing Surveys. 27 (2). ACM: 262–264. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F210376.210389">10.1145/210376.210389</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:17612128">17612128</a>.</cite>

</li>

<cite id="CITEREFNierstraszDami1995" class="citation book cs1">Nierstrasz, Oscar; Dami, Laurent (January 1995). Object-oriented software composition. Prentice Hall International. pp. 3–28. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.90.8174">10.1.1.90.8174</a>.</cite>

</li>

<cite id="CITEREFDe_HoonImotoNolanMiyano2004" class="citation journal cs1">De Hoon, Michiel JL; Imoto, Seiya; Nolan, John; Miyano, Satoru (February 2004). "Open source clustering software". Bioinformatics. 20 (9): 1453–1454. <a href="Bibcode_(identifier)" class="mw-redirect" title="Bibcode (identifier)">Bibcode</a>:<a rel="nofollow" class="external text" href="https://ui.adsabs.harvard.edu/abs/2004Bioin..20.1453D">2004Bioin..20.1453D</a>. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.3335">10.1.1.114.3335</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1093%2Fbioinformatics%2Fbth078">10.1093/bioinformatics/bth078</a>.</cite>

</li>

<cite id="CITEREFDuc_LinhDuy_HungDipe2019" class="citation book cs1">Duc Linh, Nguyen; Duy Hung, Phan; Dipe, Vu Thu (2019). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3316615.3316648">"Risk Management in Projects Based on Open-Source Software"</a>. Proceedings of the 2019 8th International Conference on Software and Computer Applications. pp. 178–183. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3316615.3316648">10.1145/3316615.3316648</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450365734</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:153314145">153314145</a>.</cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://opensource.org/history">"History of the OSI"</a>. Opensource.org. 19 September 2006.</cite>

</li>

<cite id="CITEREFPayne2002" class="citation journal cs1">Payne, Christian (2002). <a rel="nofollow" class="external text" href="https://flosshub.org/sites/flosshub.org/files/Payne2002_ISJ12_SecurityOSS.pdf">"On the security of open source software"</a> (PDF). Information Systems Journal. 12: 61–78. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1046%2Fj.1365-2575.2002.00118.x">10.1046/j.1365-2575.2002.00118.x</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:8123076">8123076</a>.</cite>

</li>

<cite id="CITEREFKaur2020" class="citation journal cs1">Kaur, Sumandeep (April 2020). <a rel="nofollow" class="external text" href="http://csjournals.com/IJCSC/PDF11-2/8.%20Suman.pdf">"Security Issues in Open-Source Software"</a> (PDF). International Journal of Computer Science & Communication: 47–51.</cite>

</li>

<cite id="CITEREFOmbredanne2020" class="citation journal cs1">Ombredanne, Philippe (October 2020). <a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FMC.2020.3011082">"Free and Open Source Software License Compliance: Tools for Software Composition Analysis"</a>. Computer. 53 (10): 262–264. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FMC.2020.3011082">10.1109/MC.2020.3011082</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:222232127">222232127</a>.</cite>

</li>

<cite id="CITEREFDuanBijlaniXuKim2017" class="citation book cs1">Duan, Ruian; Bijlani, Ashish; Xu, Meng; Kim, Taesoo; Lee, Wenke (2017). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3133956.3134048">"Identifying Open-Source License Violation and 1-day Security Risk at Large Scale"</a>. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. ACM. pp. 2169–2185. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3133956.3134048">10.1145/3133956.3134048</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450349468</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:7402387">7402387</a>.</cite>

</li>

<cite id="CITEREFAroraWrightGarman2022" class="citation journal cs1">Arora, Arushi; Wright, Virginia; Garman, Christina (2022). <a rel="nofollow" class="external text" href="https://www.jcip1.org/uploads/1/3/6/5/136597491/jcip_3.1_online.pdf#page=117">"Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials"</a> (PDF). Journal of Critical Infrastructure Policy. 3: 111–135. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.18278%2Fjcip.3.1.8">10.18278/jcip.3.1.8</a>.</cite>

</li>

<li id="cite_note-SBM_1-12"><a href="#cite_ref-SBM_1_12-0">^</a> <cite id="CITEREFBailey,_T.Greis,_J.Watters,_M.Welle,_J.2022" class="citation web cs1">Bailey, T.; Greis, J.; Watters, M.; Welle, J. (19 September 2022). <a rel="nofollow" class="external text" href="https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/cybersecurity/software-bill-of-materials-managing-software-cybersecurity-risks">"Software bill of materials: Managing software cybersecurity risks"</a>. <a href="McKinsey_%26_Company" title="McKinsey & Company">McKinsey & Company</a>. Retrieved 6 January 2024.</cite>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <cite id="CITEREFPopp2019" class="citation book cs1">Popp, Karl Michael (30 October 2019). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=w1a6DwAAQBAJ">Best Practices for commercial use of open source software</a>. BoD – Books on Demand, 2019. p. 10. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9783750403093</bdi>.</cite>

</li>

<cite id="CITEREFImtiazThornWilliams2021" class="citation book cs1">Imtiaz, Nasif; Thorn, Seaver; Williams, Laurie (October 2021). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/abs/10.1145/3475716.3475769">"A comparative study of vulnerability reporting by software composition analysis tools"</a>. Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). ACM. pp. 1–11. <a href="ArXiv_(identifier)" class="mw-redirect" title="ArXiv (identifier)">arXiv</a>:<a rel="nofollow" class="external text" href="https://arxiv.org/abs/2108.12078">2108.12078</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3475716.3475769">10.1145/3475716.3475769</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450386654</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:237346987">237346987</a>.</cite>

</li>

<cite id="CITEREFSunChengQuLi2021" class="citation book cs1">Sun, Xiaohan; Cheng, Yunchang; Qu, Xiaojie; Li, Hang (June 2021). <a rel="nofollow" class="external text" href="https://ieeexplore.ieee.org/document/9482270">"Design and Implementation of Security Test Pipeline based on DevSecOps"</a>. 2021 IEEE 4th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC). Vol. 4. IEEE. pp. 532–535. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FIMCEC51613.2021.9482270">10.1109/IMCEC51613.2021.9482270</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-7281-8535-4</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:236193144">236193144</a>.</cite>

</li>

<li id="cite_note-SB_1-16"><a href="#cite_ref-SB_1_16-0">^</a> <cite class="citation journal cs1"><a rel="nofollow" class="external text" href="https://www.federalregister.gov/documents/2021/06/02/2021-11592/software-bill-of-materials-elements-and-considerations">"Software Bill of Materials Elements and Considerations"</a>. <a href="Federal_Register" title="Federal Register">Federal Register</a>. 6 February 2021. Retrieved 6 January 2024.</cite>

</li>

<cite id="CITEREFSerafiniZacchiroli2022" class="citation book cs1">Serafini, Daniele; Zacchiroli, Stefano (September 2022). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/abs/10.1145/3555051.3555068">"Efficient Prior Publication Identification for Open Source Code"</a>. The 18th International Symposium on Open Collaboration. Vol. 4. ACM. pp. 1–8. <a href="ArXiv_(identifier)" class="mw-redirect" title="ArXiv (identifier)">arXiv</a>:<a rel="nofollow" class="external text" href="https://arxiv.org/abs/2207.11057">2207.11057</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3555051.3555068">10.1145/3555051.3555068</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450398459</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:251018650">251018650</a>.</cite>

</li>

<cite id="CITEREFChenSantosaSharmaLo2020" class="citation book cs1">Chen, Yang; Santosa, Andrew E; Sharma, Asankhaya; Lo, David (September 2020). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3377813.3381360">"Automated identification of libraries from vulnerability data"</a>. <a rel="nofollow" class="external text" href="https://ink.library.smu.edu.sg/sis_research/5501">Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Software Engineering in Practice</a>. pp. 90–99. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3377813.3381360">10.1145/3377813.3381360</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450371230</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:211167417">211167417</a>.</cite>

</li>

<cite id="CITEREFKengo_Oka2021" class="citation book cs1">Kengo Oka, Dennis (2021). "Software Composition Analysis in the Automotive Industry". <a rel="nofollow" class="external text" href="https://ieeexplore.ieee.org/document/9821841">Building Secure Cars</a>. Wiley. pp. 91–110. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1002%2F9781119710783.ch6">10.1002/9781119710783.ch6</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781119710783</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:233582862">233582862</a>.</cite>

</li>

<cite id="CITEREFRajapakseZahediBabar2021" class="citation book cs1">Rajapakse, Roshan Namal; Zahedi, Mansooreh; Babar, Muhammad Ali (2021). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3475716.3475776">"An Empirical Analysis of Practitioners' Perspectives on Security Tool Integration into DevOps"</a>. Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). pp. 1–12. <a href="ArXiv_(identifier)" class="mw-redirect" title="ArXiv (identifier)">arXiv</a>:<a rel="nofollow" class="external text" href="https://arxiv.org/abs/2107.02096">2107.02096</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3475716.3475776">10.1145/3475716.3475776</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450386654</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:235731939">235731939</a>.</cite>

</li>

<cite id="CITEREFImtiazThornWilliams2021" class="citation book cs1">Imtiaz, Nasif; Thorn, Seaver; Williams, Laurie (2021). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3475716.3475769">"A comparative study of vulnerability reporting by software composition analysis tools"</a>. Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). pp. 1–11. <a href="ArXiv_(identifier)" class="mw-redirect" title="ArXiv (identifier)">arXiv</a>:<a rel="nofollow" class="external text" href="https://arxiv.org/abs/2108.12078">2108.12078</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3475716.3475769">10.1145/3475716.3475769</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450386654</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:237346987">237346987</a>.</cite>

</li>

<li id="cite_note-22"><a href="#cite_ref-22">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://owasp.org/www-community/Component_Analysis">"Component Analysis"</a>. owasp.org.</cite>

</li>

<cite id="CITEREFFooChuaYeoAng2018" class="citation book cs1">Foo, Darius; Chua, Hendy; Yeo, Jason; Ang, Ming Yi; Sharma, Asankhaya (2018). <a rel="nofollow" class="external text" href="https://dl.acm.org/doi/pdf/10.1145/3236024.3275535">"Efficient static checking of library updates"</a>. Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. pp. 791–796. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3236024.3275535">10.1145/3236024.3275535</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781450355735</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:53079466">53079466</a>.</cite>

</li>

<cite id="CITEREFMillar2017" class="citation web cs1">Millar, Stuart (November 2017). <a rel="nofollow" class="external text" href="https://pureadmin.qub.ac.uk/ws/portalfiles/portal/128394396/SMillar_13616005_VulnerabilityDetectionInOSS.pdf">"Vulnerability Detection in Open Source Software: The Cure and the Cause"</a> (PDF). Queen's University Belfast.</cite>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-05-31" href="https://en.wikipedia.org/wiki/?title=Software_composition_analysis&oldid=1293190092">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>