.png){kind=icon}
返回
A cross-language and cross-binary type approach to binary-source software composition analysis using BM25
.png){kind=icon}
PRE
AI
DOI：10.1007/s10207-025-01148-3.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Software composition analysis (SCA) involves analyzing open-source software (OSS) components used in software development to identify license compliance issues and security vulnerabilities. It helps developers mitigate the legal and security risks associated with OSS, ensuring safer and more reliable software. Traditional SCA methods often require users to upload their source code to an SCA server for inspection, which then generates reports on component usage. However, vendors have significant concerns about this approach because source code often includes sensitive information like proprietary algorithms, core business logic, and confidential user data. To address these challenges, various SCA techniques, such as binary-binary SCA and binary-source SCA, have been proposed, though most are limited to specific programming languages. Existing SCA frameworks primarily focus on C/C + + and Java. This paper introduces the first binary-source SCA method capable of analyzing three binary types across five programming languages (C/C + + , Objective-C, Swift, Go). Our approach utilizes BM25-based text tokens, significantly reducing computational cost while maintaining detection performance. Empirical results demonstrate that our method achieves up to 81.4% recall in identifying reused OSS components, providing an efficient and scalable solution for secure software development. Additionally, this study highlights the limitations of the proposed method and suggests future research directions to address these challenges.
Keyword:
SCA
Binary-source
Software composition analysis
Binary analysis
期刊
I
IF:
3.2
论文数:
136
被引数:
1.8K
机构
引用论文
OSSFP: Precise and Scalable C/C++ Third-Party Library Detection using Fingerprinting FunctionsOSSFP：基于指纹函数的精确且可扩展的C/C++第三方库检测
PREAI
分享收藏LibDX: A Cross-Platform and Accurate System to Detect Third-Party Libraries in Binary Code.png)
2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER)
2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER)IF0
PREAI
分享收藏分享收藏BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code MatchingBinaryAI：基于智能二进制源代码匹配的二进制软件成分分析
OAAI
OAAI分享收藏Empirical Study of Software Composition Analysis Tools for C/C plus plus Binary ProgramsIEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏
查看更多内容