Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing

These days, it is common to use ready-made components, libraries, and tools in software development. Using third-party software is a good practice, since it enables the development of large applications, without taking an arduous amount of time. A Software Bill of Materials (SBOM) is a list of all t...

Full description

Bibliographic Details
Main Author: Kankaansivu, Akseli
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Jyväskylän yliopisto, University of Jyväskylä
Format: Master's thesis
Language:eng
Published: 2025
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/102734
_version_ 1833588330783047680
author Kankaansivu, Akseli
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_facet Kankaansivu, Akseli Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä Kankaansivu, Akseli Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_sort Kankaansivu, Akseli
datasource_str_mv jyx
description These days, it is common to use ready-made components, libraries, and tools in software development. Using third-party software is a good practice, since it enables the development of large applications, without taking an arduous amount of time. A Software Bill of Materials (SBOM) is a list of all the dependencies used in a software. The point of this study is to investigate cross-compilation for multiple architectures and generate a multi-architectural dataset of binaries from different open-source components for SBOM and security assessments. The dataset includes ELF-executables and object files compiled for x86, ARM, RISC-V, and MIPS architectures using different compiler optimization levels. The dataset can be used to test how SBOM-tools handle binaries across different architectures and optimization settings. The dataset can also be used for cybersecurity research like vulnerability detection. The output of this research can be used to enhance security and improve the robustness of SBOM-tools to combat the rise of supply chain attacks. While the dataset is currently limited in size, it provides groundwork for further research that could expand the dataset with additional components, compiler toolchains, and build configurations. Nykypäivänä on yleistä käyttää valmiita komponentteja, työkaluja ja kirjastoja ohjelmistokehityksessä. Se on hyvä tapa, sillä se mahdollistaa suurienkin kokonaisuuksien rakentamisen, ilman kohtuuttoman suurta ajankäyttöä. Software Bill of Materials (SBOM) on luettelo ohjelmiston kaikista osista ja riippuvuuksista. Tässä tutkimuksessa tarkasteltiin ohjelmiston ristikääntämistä eri prosessoriarkkitehtuureille. Tavoitteena oli luoda tietoaineistoa avoimen lähdekoodin komponenttien käännetyistä binääritiedostoista. Aineisto sisältää ELF-suoritettavia tiedostoja ja objektitiedostoja, jotka on käännetty x86-, ARM-, RISC-V- ja MIPS-arkkitehtuureille eri kääntäjäoptimointitasoja hyödyntäen. Tutkimusaineiston avulla voidaan arvioida, miten SBOM-työkalut käsittelevät ristikäännettyjä binääritiedostoja, jotka on luotu eri arkkitehtuureille jokaisella optimointiasetuksella. Lisäksi aineisto luo pohjan kyberturvallisuustutkimukselle, erityisesti haavoittuvuuksien tunnistamisessa. Tätä kaikkea voidaan hyödyntää SBOM-työkalujen kehittämisessä ohjelmistojen toimitusketjuihin kohdistuvien hyökkäysten torjumiseksi. Vaikka aineisto on tällä hetkellä kooltaan rajallinen, se luo hyvän perustan jatkotutkimukselle, jossa sitä voidaan laajentaa muunmuassa uusilla komponenteilla, kääntäjätyökaluilla ja kääntöasetuksilla.
first_indexed 2025-05-23T20:00:37Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "Costin, Andrei", "language": null, "element": "contributor", "schema": "dc", "qualifier": "advisor"}, {"key": "dc.contributor.author", "value": "Kankaansivu, Akseli", "language": null, "element": "contributor", "schema": "dc", "qualifier": "author"}, {"key": "dc.date.accessioned", "value": "2025-05-23T11:29:00Z", "language": null, "element": "date", "schema": "dc", "qualifier": "accessioned"}, {"key": "dc.date.available", "value": "2025-05-23T11:29:00Z", "language": null, "element": "date", "schema": "dc", "qualifier": "available"}, {"key": "dc.date.issued", "value": "2025", "language": null, "element": "date", "schema": "dc", "qualifier": "issued"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/102734", "language": null, "element": "identifier", "schema": "dc", "qualifier": "uri"}, {"key": "dc.description.abstract", "value": "These days, it is common to use ready-made components, libraries, and tools in software development. Using third-party software is a good practice, since it enables the development of large applications, without taking an arduous amount of time. A Software Bill of Materials (SBOM) is a list of all the dependencies used in a software. The point of this study is to investigate cross-compilation for multiple architectures and generate a multi-architectural dataset of binaries from different open-source components for SBOM and security assessments. The dataset includes ELF-executables and object files compiled for x86, ARM, RISC-V, and MIPS architectures using different compiler optimization levels. \n\nThe dataset can be used to test how SBOM-tools handle binaries across different architectures and optimization settings. The dataset can also be used for cybersecurity research like vulnerability detection. The output of this research can be used to enhance security and improve the robustness of SBOM-tools to combat the rise of supply chain attacks. While the dataset is currently limited in size, it provides groundwork for further research that could expand the dataset with additional components, compiler toolchains, and build configurations.", "language": "en", "element": "description", "schema": "dc", "qualifier": "abstract"}, {"key": "dc.description.abstract", "value": "Nykyp\u00e4iv\u00e4n\u00e4 on yleist\u00e4 k\u00e4ytt\u00e4\u00e4 valmiita komponentteja, ty\u00f6kaluja ja kirjastoja ohjelmistokehityksess\u00e4. Se on hyv\u00e4 tapa, sill\u00e4 se mahdollistaa suurienkin kokonaisuuksien rakentamisen, ilman kohtuuttoman suurta ajank\u00e4ytt\u00f6\u00e4. Software Bill of Materials (SBOM) on luettelo ohjelmiston kaikista osista ja riippuvuuksista. T\u00e4ss\u00e4 tutkimuksessa tarkasteltiin ohjelmiston ristik\u00e4\u00e4nt\u00e4mist\u00e4 eri prosessoriarkkitehtuureille. Tavoitteena oli luoda tietoaineistoa avoimen l\u00e4hdekoodin komponenttien k\u00e4\u00e4nnetyist\u00e4 bin\u00e4\u00e4ritiedostoista. Aineisto sis\u00e4lt\u00e4\u00e4 ELF-suoritettavia tiedostoja ja objektitiedostoja, jotka on k\u00e4\u00e4nnetty x86-, ARM-, RISC-V- ja MIPS-arkkitehtuureille eri k\u00e4\u00e4nt\u00e4j\u00e4optimointitasoja hy\u00f6dynt\u00e4en.\n\nTutkimusaineiston avulla voidaan arvioida, miten SBOM-ty\u00f6kalut k\u00e4sittelev\u00e4t ristik\u00e4\u00e4nnettyj\u00e4 bin\u00e4\u00e4ritiedostoja, jotka on luotu eri arkkitehtuureille jokaisella optimointiasetuksella. Lis\u00e4ksi aineisto luo pohjan kyberturvallisuustutkimukselle, erityisesti haavoittuvuuksien tunnistamisessa. T\u00e4t\u00e4 kaikkea voidaan hy\u00f6dynt\u00e4\u00e4 SBOM-ty\u00f6kalujen kehitt\u00e4misess\u00e4 ohjelmistojen toimitusketjuihin kohdistuvien hy\u00f6kk\u00e4ysten torjumiseksi. Vaikka aineisto on t\u00e4ll\u00e4 hetkell\u00e4 kooltaan rajallinen, se luo hyv\u00e4n perustan jatkotutkimukselle, jossa sit\u00e4 voidaan laajentaa muunmuassa uusilla komponenteilla, k\u00e4\u00e4nt\u00e4j\u00e4ty\u00f6kaluilla ja k\u00e4\u00e4nt\u00f6asetuksilla.", "language": "fi", "element": "description", "schema": "dc", "qualifier": "abstract"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2025-05-23T11:29:00Z\nNo. of bitstreams: 0", "language": "en", "element": "description", "schema": "dc", "qualifier": "provenance"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2025-05-23T11:29:00Z (GMT). No. of bitstreams: 0", "language": "en", "element": "description", "schema": "dc", "qualifier": "provenance"}, {"key": "dc.format.extent", "value": "66", "language": null, "element": "format", "schema": "dc", "qualifier": "extent"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "schema": "dc", "qualifier": "mimetype"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "schema": "dc", "qualifier": "iso"}, {"key": "dc.rights", "value": "CC BY 4.0", "language": null, "element": "rights", "schema": "dc", "qualifier": null}, {"key": "dc.title", "value": "Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing", "language": null, "element": "title", "schema": "dc", "qualifier": null}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "schema": "dc", "qualifier": null}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202505234568", "language": null, "element": "identifier", "schema": "dc", "qualifier": "urn"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "schema": "dc", "qualifier": "faculty"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "schema": "dc", "qualifier": "faculty"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "schema": "dc", "qualifier": "organization"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "schema": "dc", "qualifier": "organization"}, {"key": "dc.subject.discipline", "value": "Tietojenk\u00e4sittelytieteen maisteriohjelma", "language": "fi", "element": "subject", "schema": "dc", "qualifier": "discipline"}, {"key": "dc.subject.discipline", "value": "Master's Degree Programme in Computer Science", "language": "en", "element": "subject", "schema": "dc", "qualifier": "discipline"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "schema": "dc", "qualifier": "coar"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "schema": "dc", "qualifier": "copyright"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "schema": "dc", "qualifier": "accesslevel"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "schema": "dc", "qualifier": "publication"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "schema": "dc", "qualifier": "content"}, {"key": "dc.rights.url", "value": "https://creativecommons.org/licenses/by/4.0/", "language": null, "element": "rights", "schema": "dc", "qualifier": "url"}, {"key": "dc.description.accessibilityfeature", "value": "ei tietoa saavutettavuudesta", "language": "fi", "element": "description", "schema": "dc", "qualifier": "accessibilityfeature"}, {"key": "dc.description.accessibilityfeature", "value": "unknown accessibility", "language": "en", "element": "description", "schema": "dc", "qualifier": "accessibilityfeature"}]
id jyx.123456789_102734
language eng
last_indexed 2025-05-23T20:00:37Z
main_date 2025-01-01T00:00:00Z
main_date_str 2025
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/1e0cb01c-c9b5-42de-82ab-0e08609f6997\/download","text":"URN:NBN:fi:jyu-202505234568.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2025
record_format qdc
source_str_mv jyx
spellingShingle Kankaansivu, Akseli Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing Tietojenkäsittelytieteen maisteriohjelma Master's Degree Programme in Computer Science
title Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
title_full Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
title_fullStr Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
title_full_unstemmed Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
title_short Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
title_sort cross architectural baseline dataset generation for sbom assessment and cybersecurity testing
title_txtP Cross-Architectural Baseline Dataset Generation for SBOM Assessment and Cybersecurity Testing
topic Tietojenkäsittelytieteen maisteriohjelma Master's Degree Programme in Computer Science
topic_facet Master's Degree Programme in Computer Science Tietojenkäsittelytieteen maisteriohjelma
url https://jyx.jyu.fi/handle/123456789/102734 http://www.urn.fi/URN:NBN:fi:jyu-202505234568
work_keys_str_mv AT kankaansivuakseli crossarchitecturalbaselinedatasetgenerationforsbomassessmentandcybersecurityte