What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security

This research paper proposes a method for creating an accurate software inventory by analyzing what a program actually does in memory at runtime, rather than relying on static files. This approach helps detect supply chain attacks (where malicious code enters software through its dependencies) by catching discrepancies between what the software claims to contain and what it really executes.