一句话：论文聚焦开源软件漏洞受影响库及其生态系统的识别，并指出现有极端多标签学习方法因标签有限和忽略生态系统而效果不佳。
软件组成分析（SCA）工具广泛用于识别软件应用中使用的易受攻击库，但其依赖漏洞数据库准确记录每个漏洞影响的库。人工维护该数据库成本高且易出错。已有工作尝试采用极端多标签学习为漏洞预测受影响库，然而摘要指出这些方法在实践中效果有限，原因在于库标签数量有限以及未考虑生态系统信息。论文因此关注受影响库及其所属生态系统的识别，以改进漏洞数据库维护中的受影响库判定问题；但摘要未展开所提方法的具体技术细节与实验评估结果。
Software composition analysis (SCA) tools have been widely adopted to identify vulnerable libraries used in software applications. Such SCA tools depend on a vulnerability database to know affected libraries of each vulnerability. However, it is labor-intensive and error prone for a security team to manually maintain the vulnerability database. While several approaches adopt extreme multi-label learning to predict affected libraries for vulnerabilities, they are practically ineffective due to the limited library labels and the unawareness of ecosystems.
@inproceedings{paperbot11421,
title = {Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities},
author = {Susheng Wu and Wenyan Song and Kaifeng Huang and Bihuan Chen and Xin Peng},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639582}
}