Software Providers Research Articles

Applying TOPSIS to selecting business accounting software: A case study at Truong Son Technology Development Investment Joint Stock Company

This study aimed to build a model and set of criteria to evaluate and select business accounting software providers for Truong Son Technology Investment and Development Joint Stock Company. The study helped choose the most suitable supplier that meets the criteria that the company desired. The research proposed the Technique of Order Preference Similarity to the Ideal Solution (TOPSIS) model and was also applied in the case of selecting accounting software suppliers for Truong Son Technology Investment and Development Joint Stock Company. There were 5 business accounting software packages considered: Misa business accounting software, Bravo accounting software, FAST Accounting software, Effect accounting software, and Gamma accounting software. The ranking results of accounting software providers at Truong Son Technology Investment and Development Joint Stock Company were as follows: A1 (Misa Business Accounting Software) was the best supplier, second-ranking was A3 (FAST Accounting software), followed by A2 (Bravo Accounting Software) in third place. The findings of this study could be used as a valuable reference for businesses to choose the best supplier.

Modeling interconnected social and technical risks in open source software ecosystems

Open source software ecosystems consist of thousands of interdependent libraries, which users can combine to great effect. Recent work has pointed out two kinds of risks in these systems: that technical problems like bugs and vulnerabilities can spread through dependency links, and that relatively few developers are responsible for maintaining even the most widely used libraries. However, a more holistic diagnosis of systemic risk in software ecosystem should consider how these social and technical sources of risk interact and amplify one another. Motivated by the observation that the same individuals maintain several libraries within dependency networks, we present a methodological framework to measure risk in software ecosystems as a function of both dependencies and developers. In our models, a library’s chance of failure increases as its developers leave and as its upstream dependencies fail. We apply our method to data from the Rust ecosystem, highlighting several systemically important libraries that are overlooked when only considering technical dependencies. We compare potential interventions, seeking better ways to deploy limited developer resources with a view to improving overall ecosystem health and software supply chain resilience.

Proposing a Zero Trust and Blockchain Approach to Tackle Software Supply Chain Attacks

Proposing a Zero Trust and Blockchain Approach to Tackle Software Supply Chain Attacks

Construction of Software Supply Chain Threat Portrait Based on Chain Perspective

With the rapid growth of the software industry, the software supply chain (SSC) has become the most intricate system in the complete software life cycle, and the security threat situation is becoming increasingly severe. For the description of the SSC, the relevant research mainly focuses on the perspective of developers, lacking a comprehensive understanding of the SSC. This paper proposes a chain portrait framework of the SSC based on a resource perspective, which comprehensively depicts the threat model and threat surface indicator system of the SSC. The portrait model includes an SSC threat model and an SSC threat indicator matrix. The threat model has 3 levels and 32 dimensions and is based on a generative artificial intelligence model. The threat indicator matrix is constructed using the Attack Net model comprising 14-dimensional attack strategies and 113-dimensional attack techniques. The proposed portrait model’s effectiveness is verified through existing SSC security events, domain experts, and event visualization based on security analysis models.

How to strengthen the software supply chain

Defenders against software supply chain attacks have to keep upping their game, as the attackers do.

The blind leading the blind: Co-production of medication safety solutions for people with sight impairment in community pharmacy

Abstract Introduction Around 237 million medication errors occur each year in England, with an estimated cost of £98 million1. We carried out a scoping review identified that people with sight impairments were a group at high risk of errors (under review). Aim To improve medication safety for people with sight impairments by developing an ‘App’ to help them manage medications. Methods We attended an initial in-person ‘Tea and Tech’ stakeholder group led by Henshaws Sight Loss charity in Manchester, UK and sought feedback from people with sight impairments about their experiences of medication. Ethical approval for this study was granted by The University of Manchester Research Ethics Committee (Ref: 2021-11098-18381). Co-design workshops – Due to the ongoing COVID-19 pandemic, we held two online workshops, minimising the need for travel and face to face meetings2. Workshops were promoted by RNIB amongst their ‘Community Connectors’. Community Pharmacists who were part of our NIHR Greater Manchester Patient Safety Translational Research Centre were also invited to participate to provide their perspective as healthcare professionals. Sessions were co-facilitated by patient safety researchers and researchers acting as notetakers. The first workshop (June 2021), focussed on the experiences of people with sight impairment around using medication, and potential solutions to these. The second workshop (July 2021), ranked these potential solutions, prioritising ideas for development. Results Those attending the Tea and Tech group warned against developing ‘another App’, highlighting problems caused by their sight impairment around installing and using ‘Apps’ generally. Co-design workshops were attended by six people with sight impairment and six community pharmacists. The difficulties reported included inability to distinguish between medications, to access dosing instructions (on medication labels) and safety information within product information leaflets. The solutions ranked as most important were 1) one to one consultations with pharmacists 2) improving medication packaging and 3) the need for pharmacist training. Discussions highlighted the lack of a system for pharmacists to reliably identify people with sight impairments. This led us to develop a pharmacy software system called Find Logo And Give Medication advice (FLAG-Me Vision) which identifies people with sight impairments using existing data within the electronic health record. An on-screen alert (shown as a logo) on the patient medication record, prompts pharmacy staff to offer a one-to-one consultation. Resources available on our website (www.flag-me.org) supports consultations and meets the remit for pharmacist training. Our prototype software created by Imago Student Software company at The University of Manchester, was tested using dummy NHS records and Hospital Run (open-source software). Discussion/Conclusion Market discovery and testing for FLAG-Me Vision has been undertaken via iCURe DISCOVER programme3. Feedback is that FLAG-Me Vision is well received by people with sight impairments and pharmacists alike. Future plans include piloting this software with pharmacy software suppliers within one community pharmacy chain in Greater Manchester.

Bayesian-Based Traffic Safety Evaluation Study for Driverless Infiltration

Although driverless technology belongs to the frontier of science and technology, there is no sufficient actual data. From the lack of a comprehensive systematic evaluation method of traffic safety under driverless penetration, considering the impact of the three core systems of driverless perception, decision-making, control, and the complex road factors on the safety of driving, we review the main risk causal factors through the analysis of the accident causal model STAMP and put forward the fusion of the Leaky Noisy-OR Gate and Bayesian network model. The Bayesian network professional analysis tool GeNIe 2.0 was used to simulate, analyze, and evaluate the driverless traffic risk Bayesian network model, which accurately assessed the traffic safety risk under driverless penetration and diagnosed and identified the sensitive risk factors. The results of this study concluded that, in order to effectively deal with the future traffic safety risks of driverless vehicles, vehicle enterprises, research institutions, software and hardware suppliers in the field of driverless driving should strengthen the research and development and manufacturing of key components such as perception, and enhance the depth of research and development of AI decision-making software, which provides a new way of thinking about the management of the safety risk of driverless traffic and a theoretical basis for the development and implementation of risk control measures.

The Optimization of Digital Currency Electronic Payment in RMB Based on Big Data and Fuzzy Theory

Supply chain management is a key component of the Electronic-China Yuan (e-CNY) infrastructure and is crucial to developing and using e-CNY. This paper first provides an overview of the features of e-CNY and the idea of incorporating supply chain management into the creation of e-CNY software to better meet user payment requirements. This will help to reinforce the CNY's dominant position in the global monetary system. Meanwhile, this paper uses the fuzzy theory evaluation method to assess the software supply chain management informatization level. More broadly, this paper discusses the development level of digital enterprise supply chain management informatization to understand the current situation of e-CNY software supply chain management. The network's energy usage will increase when e-CNY software is developed. This research suggests a routing protocol based on the combination of chaotic particle swarm optimization (CPSO) and ant colony algorithm (ACA). It employs a new CPSO algorithm to optimize the cluster head selection.

A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation?

A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation?

Software Supply Chain Security [Guest Editors’ Introduction

Software Supply Chain Security [Guest Editors’ Introduction

Journey to the Center of Software Supply Chain Attacks

Journey to the Center of Software Supply Chain Attacks

A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda

A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda

Delta Security Certification for Software Supply Chains

Delta Security Certification for Software Supply Chains

Breaking Triopoly to Achieve Sustainable Smart Digital Infrastructure Based on Open-Source Diffusion Using Government–Platform–User Evolutionary Game

Technological innovations, including the Internet of Things (IoT) and machine learning, have facilitated the emergence of autonomous systems, promoting triple bottom line (TBL) sustainability. However, the prevalent triopoly of Android, iOS, and Windows introduces substantial obstacles for smart device manufacturers in pursuit of independent innovation. This research endeavors to elucidate how open-source operating systems can counteract this triopoly and catalyze sustainable digital development. Utilizing evolutionary game theory, we scrutinize the interplay among governments, platforms, and users in championing open-source diffusion. Our analysis unveils two potent evolutionary strategies—incentivized engagement and disengagement—that notably expedite open-source diffusion and attenuate software supply chain risks affiliated with the Android–iOS–Windows triopoly (results). Consequently, this research highlights the critical role of augmenting stakeholder collaboration and bolstering platform reputation in propelling open-source diffusion, thereby providing valuable theoretical insights and practical guidance for the sustainable advancement of smart digital infrastructure.

Research on railway BIM platform framework based on homemade graphics engine

At present, BIM platforms rely on foreign software. Homemade software and industry applications are mostly secondary developments, which present stranglehold problems caused by interruptions to the software supply. To solve the problem, key technical research on the 3D integrated design of railway engineering was stuedied based on homemade graphics engines to propose an innovative railway BIM platform framework. The entire process was completed from the top-level design to the engineering verification of the platform. The co-designed mechanism of a "center model and link" hybrid mode was constructed, which solved the difficulties of data management and increment synchronization at a large scale, achieving teamwork among surveying and mapping, alignments, and bridges. The results of this study could provide strong support for the development of BIM software for a whole railway and all majors.

Predicting Technology and Its Impact on Humanity

This special issue of Computer reflects an intertwining of technology and sociopolitical factors. Articles range from medicine to war, from unmanned aircraft to software supply chains, and to the interconnection of technologies in an increasingly complex world.

1-to-1 or 1-to-n? Investigating the Effect of Function Inlining on Binary Similarity Analysis

Binary similarity analysis is critical to many code-reuse-related issues, where function matching is its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary similarity analysis works, in which one function in a binary file is matched against one function in a source file or binary file. However, we discover that the function mapping is a more complex problem of “ 1-to-n ” (one binary function matches multiple source functions or binary functions) or even “ n-to-n ” (multiple binary functions match multiple binary functions) due to the existence of function inlining , different from traditional understanding. In this article, we investigate the effect of function inlining on binary similarity analysis. We carry out three studies to investigate the extent of function inlining, the performance of existing works under function inlining, and the effectiveness of existing inlining-simulation strategies. Firstly, a scalable and lightweight identification method is designed to recover function inlining in binaries. 88 projects (compiled in 288 versions and resulting in 32,460,156 binary functions) are collected and analyzed to construct four inlining-oriented datasets for four security tasks in the software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability detection, and patch presence test. Datasets reveal that the proportion of function inlining ranges from 30–40% when using O3 and sometimes can reach nearly 70%. Then, we evaluate four existing works on our dataset. Results show most existing works neglect inlining and use the “1-to-1” mechanism. The mismatches cause a 30% loss in performance during code search and a 40% loss during vulnerability detection. Moreover, most inlined functions would be ignored during OSS reuse detection and patch presence test, thus leaving these functions risky. Finally, we analyze two inlining-simulation strategies on our dataset. It is shown that they miss nearly 40% of the inlined functions, and there is still a large space for promotion. By precisely recovering when function inlining happens, we discover that inlining is usually cumulative when optimization increases. Thus, conditional inlining and incremental inlining are recommended to design a low-cost and high-coverage inlining-simulation strategy.

How Does Shortage of Health IT Professionals Impact on the Digital Health Transformation?

The need for software suppliers to react swiftly to the plethora of application requests and constantly shifting market requirements is one of the major problems facing the health IT business in the context of digital health transformation. This can only be achieved when the necessary staff and resources are available. The objective of this work is to identify challenges health IT companies are confronted with related to personnel capacities and skilled workers. Using a questionnaire distributed through newsletters and social media among representatives of software companies and hospitals we collected information on current hurdles of health software providers and their strategies to overcome these in order to address the demands of the digital health transformation. The main findings of the survey are that scarce resources in software development are among the reasons for not achieving strategic goals on time in the health IT sector and for not being able to react flexibly to market changes. A strategy to overcome missing expert knowledge and own resources without free capacity is to hire external resources. With the ever-changing landscape of digital health, it is essential to have skilled workers with knowledge on the peculiarities of clinical workflows. The existing shortage of skilled workers leads to a reduction of innovative power in the health IT sector, potentially slowing down the digital health transformation.

On the prevalence of software supply chain attacks: Empirical study and investigative framework

Software Supply Chain Attacks (SSCAs) typically compromise hosts through trusted but infected software. The intent of this paper is twofold: First, we present an empirical study of the most prominent software supply chain attacks and their characteristics. Second, we propose an investigative framework for identifying, expressing, and evaluating characteristic behaviours of newfound attacks for mitigation and future defense purposes. We hypothesize that these behaviours are statistically malicious, existed in the past, and thus could have been thwarted in modernity through their cementation x-years ago. To measure this, a large scale ground-truth corpus of over 10 million functions is assembled from three file classes: malware, benign, and Windows 10 binaries. An expressive query system is proposed for matching behaviours on top of semantic graphs constructed with data-flow, control-flow and AST-annotations. We leverage conditional probabilities to assess malicious intent by considering the SSCA behaviours matched in the three file classes. Our analysis reveals that the presence of an SSCA behaviour within a binary indicates malware with 86–100% probability. We also annotate each SSCA behaviour with context information that, when applied as a filter over matched dataset samples, is found to boost malicious intent by up to 30%. In addition, we present a novel data-flow metric, parametric momentum, which is a powerful gauge of malicious intent that alone matches 12.71% of malware with zero false positives. Finally, we perform a temporal analysis of the SSCA behaviours present in our dataset and discover that they have been available for 13–21 years prior to each attack; conceivably enough time to be identified for mitigating the SSCA instances.

How does IT capability affect knowledge acquisition in the presence of a dominant supplier?

PurposeThis study aims to examine how three types of information technology (IT) capability (supplier technological capability, customer technology-sensing capability and relatedness of IT infrastructure) facilitate knowledge acquisition by the customer when the supplier is dominant in the supplier-customer relationship.Design/methodology/approachThe unit of analysis was project. The authors designed two different questionnaires that were responded by the project manager of an enterprise resource planning (ERP) software supplier and the contact person of the customer organization in the same project, respectively. The two questionnaires were matched by means of project name. The final sample included a total of 136 projects. The authors used ordinary least squares to test the research hypotheses.FindingsThe authors found that supplier power advantage negatively influenced knowledge acquisition by the customer. The three types of IT capability did not have direct impacts on knowledge acquisition. The moderating effect of customer technology-sensing capability was not significant either. However, supplier technological capability and relatedness of IT infrastructure attenuated the negative effect of supplier power advantage on knowledge acquisition, indicating that both factors promoted knowledge acquisition.Originality/valueKnowledge acquisition is important for the success of software implementation in the supplier-customer relationship. There is limited evidence in the literature on how to apply externally oriented IT capability to enhance knowledge management, improve knowledge acquisition and manage the business relationship that is typically dominated by the software supplier. The authors provide evidence to examine related issues.