You are here: Home » Events » Empirical Insights into Software and AI Supply Chains: Understanding and Enhancing SBOM and AIBOM

Empirical Insights into Software and AI Supply Chains: Understanding and Enhancing SBOM and AIBOM

Schedule and location

University of Oulu, Pentti Kaiteran katu 1, 90570 Oulu

November 18 at 10.00-16.00

November 19 at 10.00-16.00

Room details will be updated later.

 

Registration

Registration is open until November 8.

Speaker

Prof. Giuseppe Scanniello, University of Salerno

Organizer

Dr. Rahul Mohanani, University of Oulu

Overview

Modern software and AI systems increasingly rely on third-party components, libraries, services, datasets, and machine-learning models, creating complex supply chains in which security, licensing, provenance, and other risks can propagate across dependencies. SBOMs and AIBOMs have emerged as mechanisms for providing visibility into these supply chains, but their practical value depends on their adoption, accuracy, completeness, maintenance cost, and integration into development and organizational processes.

The course introduces empirical approaches to studying software engineering phenomena and applies them to the emerging area of software and AI supply chains. The first part provides an introduction to empirical research in Software Engineering, discussing qualitative and quantitative strategies and research methods such as surveys, case studies, experiments, systematic and multivocal literature reviews, mining software repositories, and cohort studies.

The second part focuses on software and AI supply chains, introducing Software Bill of Materials (SBOMs) and AI Bill of Materials (AIBOMs), their role in managing dependencies and supply-chain risks, and the empirical evidence currently available. The course will discuss, in particular, empirical studies on SBOM adoption among practitioners, mining studies of open-source repositories, empirical evaluation of SBOM generators, and a multivocal literature review on AIBOMs.

The course will also consider how empirical evidence can inform the development and evaluation of SBOM/AIBOM tooling, including fine-grained SBOM generation and AIBOM generation.

Program

Day 1 – Empirical Methods in Software Engineering

  • Software Engineering as an empirical discipline
  • Scientific, engineering, empirical, and analytical research approaches
  • The role of empirical evidence in Software Engineering
  • Human factors and the socio-technical nature of software engineering
  • From intuition and anecdotal evidence to validated knowledge
  • Qualitative vs. quantitative empirical research
  • Research questions and the relationship between questions, data, and methods
  • Overview of empirical strategies:
    • Surveys
    • Interviews and qualitative studies
    • Case studies
    • Controlled experiments
    • Systematic and multivocal literature reviews
    • Mining software repositories
    • Cohort studies
  • Strengths, limitations, validity considerations, and appropriate use of different empirical strategies
  • Interactive exercise: designing an empirical study for a software engineering problem
  • Transition from empirical research methods to the study of software supply chains
The first day will therefore place considerably more emphasis on empirical methods than the current high-level presentation, using the SBOM/AIBOM domain as a running example.
Day 2 – Empirical Insights into Software and AI Supply Chains
  • Software supply chains and their socio-technical nature
  • SBOMs: motivation, concepts, standards, and use
  • AIBOMs: motivation and the representation of AI-related components
  • Current state of empirical evidence on SBOMs and AIBOMs
  • Case study: interviews with software practitioners on SBOM adoption
  • Mining software repositories: SBOM adoption in open-source software
  • Empirical evaluation: accuracy of GitHub's dependency graph/SBOM generation
  • Multivocal literature review: what is currently known about AIBOMs
  • Empirical evidence on SBOM/AIBOM generation and consumption
  • Development and evaluation of fine-grained SBOM and AIBOM generators
  • Practical implications for practitioners, tool builders, and other stakeholders
  • Discussion and synthesis: how to formulate and evaluate empirical research questions in software and AI supply chains

 

Credit points

Doctoral students participating in the seminar can obtain 2 credit points. This requires participating and completing the assignments.

Registration fee

This seminar is free-of-charge for Inforte.fi member organization's staff and their PhD students. For others the participation fee is 400 €. The participation fee includes access to the event and the event materials. Lunch and dinner are not included.