一句话：提出 CENTRIS，通过切分 OSS 并检测独特片段复用，精确可扩展地识别经修改且嵌套的开源软件复用。
开源软件复用普遍且常被修改和嵌套，导致漏洞传播与许可证违规，但精确识别被修改的 OSS 复用很困难。CENTRIS 通过切分开源代码库并只检测 OSS 独特片段的复用，从而在存在嵌套组件时精确识别经修改复用；为提升可扩展性，它消除冗余代码比较并用哈希函数加速搜索。作者在 10,241 个 GitHub 项目、229,326 个版本、800 亿行代码上评估，发现修改复用比精确复用常见 20 倍，CENTRIS 平均不到一分钟内达到 91% 精确率和 94% 召回率，远超未考虑修改与嵌套的克隆检测技术。
Open-source software (OSS) is widely reused as it provides convenience and efficiency in software development. Despite evident benefits, unmanaged OSS components can introduce threats, such as vulnerability propagation and license violation. Unfortunately, however, identifying reused OSS components is a challenge as the reused OSS is predominantly modified and nested. In this paper, we propose CENTRIS, a precise and scalable approach for identifying modified OSS reuse. By segmenting an OSS code base and detecting the reuse of a unique part of the OSS only, CENTRIS is capable of precisely identifying modified OSS reuse in the presence of nested OSS components. For scalability, CENTRIS eliminates redundant code comparisons and accelerates the search using hash functions. When we applied CENTRIS on 10,241 widely-employed GitHub projects, comprising 229,326 versions and 80 billion lines of code, we observed that modified OSS reuse is a norm in software development, occurring 20 times more frequently than exact reuse. Nonetheless, CENTRIS identified reused OSS components with 91% precision and 94% recall in less than a minute per application on average, whereas a recent clone detection technique, which does not take into account modified and nested OSS reuse, hardly reached 10% precision and 40% recall.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2102-06182,
title = {CENTRIS: A Precise and Scalable Approach for Identifying Modified Open-Source Software Reuse},
author = {Seunghoon Woo and Sunghan Park and Seulbae Kim and Heejo Lee and Hakjoo Oh},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00083}
}