{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T06:16:39Z","timestamp":1783059399733,"version":"3.54.6"},"reference-count":79,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T00:00:00Z","timestamp":1773705600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T00:00:00Z","timestamp":1773705600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,3,17]]},"DOI":"10.1109\/saner67736.2026.00124","type":"proceedings-article","created":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T19:41:17Z","timestamp":1783021277000},"page":"1057-1068","source":"Crossref","is-referenced-by-count":0,"title":["The SBOM Gap: Adoption and Compliance in Open Source Software"],"prefix":"10.1109","author":[{"given":"Md Fazle","family":"Rabbi","sequence":"first","affiliation":[{"name":"Idaho State University,Department of Computer Science,Pocatello,ID,United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Asif K.","family":"Turzo","sequence":"additional","affiliation":[{"name":"University of Massachusetts,Department of Computer & Information Science,Dartmouth,MA,United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Arifa I.","family":"Champa","sequence":"additional","affiliation":[{"name":"Idaho State University,Department of Computer Science,Pocatello,ID,United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Minhaz F.","family":"Zibran","sequence":"additional","affiliation":[{"name":"University of Massachusetts,Department of Computer & Information Science,Dartmouth,MA,United States"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2022.3187912"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.7759\/cureus.47026"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.55730\/1300-0632.3841"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10131-8"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2023.301508"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627129"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3600162"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.18280\/ijsse.110505"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCNT51525.2021.9579611"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM52596.2021.9652901"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00219"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3623347"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564556"},{"key":"ref15","article-title":"The White House","volume-title":"Executive order on improving the nation\u2019s cybersecurity","year":"2021"},{"key":"ref16","article-title":"NTIA","volume-title":"The minimum elements for a software bill of materials (sbom)","year":"2021"},{"key":"ref17","article-title":"OWASP CycloneDX Team","volume-title":"Cyclonedx specification overview","year":"2025"},{"key":"ref18","article-title":"SPDX Community","volume-title":"Spdx specification overview","year":"2025"},{"key":"ref19","article-title":"NIST","volume-title":"Software identification (swid) tags","year":"2025"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09959-3"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME58846.2023.00016"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3237100"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SERA61261.2024.10685624"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3637659"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3669975"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240322"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3654442"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SANER-C62648.2024.00023"},{"key":"ref29","volume-title":"Replication package of \u201cthe sbom gap: Adoption and compliance in open source software","author":"Rabbi","year":"2026"},{"key":"ref30","article-title":"CISA","volume-title":"Framing software component transparency: Establishing a common software bill of materials (sbom)","year":"2024"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3756681.3756998"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.70828\/rned4427"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/Blockchain62396.2024.00082"},{"key":"ref34","author":"Lin","year":"2023","journal-title":"Generating software bill of material for vulnerability management and license compliance"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.6997"},{"key":"ref36","first-page":"1","article-title":"Towards traceability in data ecosystems using a bill of materials model","volume-title":"Proceedings of the 11th International Workshop on Science Gateways (IWSG 2019)","volume":"2975","author":"Barclay"},{"key":"ref37","volume-title":"Artificial intelligence bill of materials (ai-bom)","author":"Chan","year":"2017"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560432"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ISTAS57930.2023.10305922"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3670926"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.2172\/2204407"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3302956"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3605098.3635927"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3672608.3707940"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2025.112540"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387450"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3663533.3664037"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-71769-7_12"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00035"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-024-10527-8"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00057"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09825-8"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/svm66695.2025.00010"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3715744"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3165056"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10143-4"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3530785"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3643773"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3443741"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2019.00013"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9393-5"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9376-6"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9508-2"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2024.112179"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-3385-9_12"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/BF01102759"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1958.tb00292.x"},{"key":"ref68","first-page":"6","article-title":"Regression modeling strategies","author":"Harrell","year":"2022","journal-title":"R package version"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1002\/SERIES1345"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2025.3550881"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3517208.3523753"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.14722\/madweb.2022.23010"},{"key":"ref73","article-title":"OWASP Dependency-Track Team","volume-title":"Owasp dependency-track documentation","year":"2025"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3102221"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2910856"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2013.07.039"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10130-9"},{"key":"ref78","article-title":"OWASP Foundation","volume-title":"Cryptography bill of materials (cbom)","year":"2025"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9512-6"}],"event":{"name":"2026 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)","location":"Limassol, Cyprus","start":{"date-parts":[[2026,3,17]]},"end":{"date-parts":[[2026,3,20]]}},"container-title":["2026 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11576582\/11576527\/11576707.pdf?arnumber=11576707","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T05:23:41Z","timestamp":1783056221000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11576707\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,17]]},"references-count":79,"URL":"https:\/\/doi.org\/10.1109\/saner67736.2026.00124","relation":{},"subject":[],"published":{"date-parts":[[2026,3,17]]}}}