一句话：提出 OSSFP，通过核心函数指纹去除噪声，实现 C/C++ 第三方库精确、可扩展检测。
第三方库（TPL）在提升开发效率的同时也可能引入缺陷与漏洞，因此软件成分分析（SCA）工具被用于检测和管理 TPL 使用。然而，现有工具的特征数据集包含大量常见且琐碎的函数，导致其在真实 C/C++ 项目中难以兼顾检测精度与速度。本文提出 OSSFP，一种面向大规模真实项目的 SCA 框架：它为每个开源软件项目生成唯一指纹，通过剔除常见和琐碎函数、仅保留核心函数来构建指纹索引，从而显著减小特征库规模、加速检测并排除噪声以提升准确性。作者在包含 23,427 个 C/C++ 仓库、585,683 个版本、900 亿行代码的大数据集上评估，OSSFP 达到 90.84% 的召回率和 90.34% 的精确率，分别优于最先进工具 35.31% 和 3.71%；每个项目平均仅需 0.12 秒，比其他工具快 22 倍，并展现出良好的大规模可扩展性。
Third-party libraries (TPLs) are frequently used in software to boost efficiency by avoiding repeated developments. However, the massive using TPLs also brings security threats since TPLs may introduce bugs and vulnerabilities. Therefore, software composition analysis (SCA) tools have been proposed to detect and manage TPL usage. Unfortunately, due to the presence of common and trivial functions in the bloated feature dataset, existing tools fail to precisely and rapidly identify TPLs in C/C++ real-world projects. To this end, we propose OSSFP, a novel SCA framework for effective and efficient TPL detection in large-scale real-world projects via generating unique fingerprints for open source software. By removing common and trivial functions and keeping only the core functions to build the fingerprint index for each TPL project, OSSFP significantly reduces the database size and accelerates the detection process. It also improves TPL detection accuracy since noises are excluded from the fingerprints. We applied OSSFP on a large data set containing 23,427 C/C++ repositories, which included 585,683 versions and 90 billion lines of code. The result showed that it could achieve 90.84% of recall and 90.34% of precision, which outperformed the state-of-the-art tool by 35.31% and 3.71%, respectively. OSSFP took only 0.12 seconds on average to identify all TPLs per project, which was 22 times faster than the other tool. OSSFP has proven to be highly scalable on large-scale datasets.
@inproceedings{WuXTZWLSZL23,
title = {OSSFP: Precise and Scalable C/C++ Third-Party Library Detection using Fingerprinting Functions},
author = {Jiahui Wu and Zhengzi Xu and Wei Tang and Lyuye Zhang and Yueming Wu and Chengyue Liu and Kairan Sun and Lida Zhao and Yang Liu},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00034}
}