- Home
- Archives
- 2026
- Vol. 6 Issue 5
- Article
An explainable sbom-driven framework for software supply chain risk assessment and vulnerability prioritization
Authors
1 M.Tech Student, Department of Computer Science Engineering & Application, Bhagwnat Institute of Technology, Muzaffarnagar, Uttar Pradesh, India. 2 Assistant Professors, Department of Computer Science Engineering & Application, Bhagwnat Institute of Technology, Muzaffarnagar, Uttar Pradesh, India.
Article Information
- Published In
- Volume 6, Issue 5 (2026)
- Published Online
- September-October 2026
- Pages
- 214-217
- Article Type
- Original Article
- Check for updates
-
References
1. National Institute of Standards and Technology (NIST), “Software Security in Supply Chains: Software Bill of Materials (SBOM),” updated Nov. 1, 2024. Available: https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance-20
2. Y. Xiao, D. Kirat, D. L. Schales, J. Jang, L. Xing, and X. Liao, “JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs,” in Proc. Network and Distributed System Security Symposium (NDSS), 2025. Available: https://www.ndss-symposium.org/ndss-paper/jbomaudit-assessing-the-landscape-compliance-and-security-implications-of-java-sboms/
3. National Telecommunications and Information Administration (NTIA), “The Minimum Elements for a Software Bill of Materials (SBOM),” U.S. Department of Commerce, July 2021. Available: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
4. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners, “2026 Minimum Elements for a Software Bill of Materials (SBOM),” July 29, 2026. Available: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom
5. S. Nocera, S. Romano, M. Di Penta, R. Francese, and G. Scanniello, “On the Adoption of Software Bill of Materials in Open-Source Software Projects,” Journal of Systems and Software, vol. 230, art. 112540, 2025. doi: 10.1016/j.jss.2025.112540.
6. Forum of Incident Response and Security Teams (FIRST), “Exploit Prediction Scoring System (EPSS): FAQ and Methodology.” Available: https://www.first.org/epss/
7. Cybersecurity and Infrastructure Security Agency (CISA), “Known Exploited Vulnerabilities (KEV) Catalog.” Available: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
8. Ecma International, “ECMA-424: CycloneDX Bill of Materials Specification,” 2nd ed., Dec. 2025. Available: https://ecma-international.org/publications-and-standards/standards/ecma-424/
2. Y. Xiao, D. Kirat, D. L. Schales, J. Jang, L. Xing, and X. Liao, “JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs,” in Proc. Network and Distributed System Security Symposium (NDSS), 2025. Available: https://www.ndss-symposium.org/ndss-paper/jbomaudit-assessing-the-landscape-compliance-and-security-implications-of-java-sboms/
3. National Telecommunications and Information Administration (NTIA), “The Minimum Elements for a Software Bill of Materials (SBOM),” U.S. Department of Commerce, July 2021. Available: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
4. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners, “2026 Minimum Elements for a Software Bill of Materials (SBOM),” July 29, 2026. Available: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom
5. S. Nocera, S. Romano, M. Di Penta, R. Francese, and G. Scanniello, “On the Adoption of Software Bill of Materials in Open-Source Software Projects,” Journal of Systems and Software, vol. 230, art. 112540, 2025. doi: 10.1016/j.jss.2025.112540.
6. Forum of Incident Response and Security Teams (FIRST), “Exploit Prediction Scoring System (EPSS): FAQ and Methodology.” Available: https://www.first.org/epss/
7. Cybersecurity and Infrastructure Security Agency (CISA), “Known Exploited Vulnerabilities (KEV) Catalog.” Available: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
8. Ecma International, “ECMA-424: CycloneDX Bill of Materials Specification,” 2nd ed., Dec. 2025. Available: https://ecma-international.org/publications-and-standards/standards/ecma-424/
Related Articles
Share Article
*Instagram doesn't support direct link sharing from web. Copy the link and share it in your Instagram story or post.