| 摘要: |
| 第三方库 (third-party library, TPL)在软件开发中得到了广泛应用, 但也带来了安全漏洞和许可证冲突等风险. 为应对这些挑战, 软件成分分析 (software composition analysis, SCA)技术应运而生, 旨在通过识别和分析软件中使用的开源组件及其依赖关系, 帮助开发者检测安全漏洞、过时补丁和许可证合规性问题, 确保软件供应链的安全. 然而, 现有SCA工具在C/C++领域存在3大局限: 缺乏全面的TPL特征库、难以识别库粒度复用、对TPL依赖关系的分析能力不足. 针对上述问题, 提出C/C++源代码软件成分分析技术——CAnalyzer, 用于软件库粒度的复用检测场景. CAnalyzer通过整合15个平台的数据, 构建了一个包含33100个TPL和30047290个函数的特征库, 并通过特征库预处理与多重阈值匹配策略, 显著提升了TPL检测的准确性. 此外, CAnalyzer通过解析源码中的依赖指令, 实现了TPL间依赖关系的自动化构建. 实验结果表明, CAnalyzer在TPL检测中的精确率为90.63%, 召回率为86.57%, 在两项指标上均优于现有方法CENTRIS、TPLite和OSSFP. 在TPL依赖关系检测中, CAnalyzer的召回率和精确率分别为94.79%和98.99%. 目前, CAnalyzer已被OpenHarmony社区采纳, 在689个代码仓库中识别出166项外部组件, 体现了其在开源社区管理中的应用价值. |
| 关键词: 开源软件复用 软件成分分析 第三方库依赖 |
| DOI：10.13328/j.cnki.jos.007587 |
| 分类号:TP311 |
| 基金项目:国家重点研发计划(2024YFF0908000); 中国博士后科学基金(2024M750375); CCF华为胡杨林基金软件工程专项(鸿蒙专题) (CCF-HuaweiSE20240210) |
|
| CAnalyzer: Software Composition Analysis Technique for C/C++ Source Code |
|
XU Mei-Qiu, WANG Shu-Jing, WANG Ying, YU Hai, ZHU Zhi-Liang
|
|
Software College, Northeastern University, Shenyang 110169, China
|
| Abstract: |
| Third-party libraries (TPLs) are widely used in software development but also introduce risks such as security vulnerabilities and license conflicts. In response, software composition analysis (SCA) has emerged to help developers detect security vulnerabilities, outdated patches, and license compliance issues by identifying and analyzing open-source components and their dependencies, thereby ensuring the security of software supply chains. However, existing SCA techniques in the C/C++ domain face three major limitations: a lack of comprehensive TPL feature libraries, difficulty in detecting library-granularity reuse, and insufficient capability to analyze TPL dependencies. To address these limitations, a SCA technique for C/C++ source code—CAnalyzer—is proposed for software library-granularity reuse detection scenarios. By integrating data from 15 platforms, CAnalyzer builds a feature database containing 33100 TPLs with 30047290 functions. Meanwhile, the precision of TPL detection is significantly improved through feature database preprocessing and a multi-threshold matching strategy. Additionally, CAnalyzer analyzes dependency directives in the source code to automatically construct dependencies among TPLs. Experimental results show that CAnalyzer achieves a precision of 90.63% and a recall of 86.57% in TPL detection, outperforming CENTRIS, TPLite, and OSSFP in both metrics. In TPL dependency detection, CAnalyzer achieves a recall of 94.79% and a precision of 98.99%. Currently, CAnalyzer has been adopted by the OpenHarmony community and has identified 166 external components across 689 code repositories, demonstrating its practical value in open-source community management. |
| Key words: open-source software reuse software composition analysis (SCA) third-party library (TPL) dependency |
