一句话：提出 Jaralyzer，直接分析字节码以检测重编译、重打包等修改后依赖中的已知漏洞。
现代 Java 项目大量依赖开源软件，平均约 71% 的代码来自 OSS 依赖，随之而来的已知漏洞风险促使研究者与工业界开发依赖扫描器。然而现有扫描器难以应对 Java 生态中常见的依赖修改形式，如重编译、重打包与重新捆绑，因为这些扫描器通常依赖依赖项的元数据或源码。本文提出 Jaralyzer，一个以字节码为中心的 Java 依赖扫描器，不假定被包含的 OSS 依赖的元数据或源码可用，而是直接分析其字节码来识别已知漏洞。作者在 56 个流行 OSS 组件上进行了评估，结果表明 Jaralyzer 在检测被修改依赖中的漏洞方面优于其他流行扫描器，是唯一能够覆盖上述所有修改类型并检出漏洞的扫描器；即便面对未修改依赖，它也比当前最先进的代码中心扫描器 Eclipse Steady 多检出 28 个真实漏洞，并减少 29 条误报。
On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code bases. This high degree of OSS reliance comes with a considerable security risk of adding known security vulnerabilities to a code base. To remedy this risk, researchers and companies have developed various dependency scanners, which try to identify inclusions of known-to-be-vulnerable OSS dependencies. However, there are still challenges that modern dependency scanners do not overcome, especially when it comes to dependency modifications, such as re-compilations, re-bundlings or re-packagings, which are common in the Java ecosystem. To overcome these challenges, we present Jaralyzer, a bytecode-centric dependency scanner for Java. Jaralyzer does not rely on the metadata or the source code of the included OSS dependencies being available but directly analyzes a dependency’s bytecode. Our evaluation across 56 popular OSS components demonstrates that Jaralyzer outperforms other popular dependency scanners in detecting vulnerabilities within modified dependencies. It is the only scanner capable of identifying vulnerabilities across all the above mentioned types of modifications. But even when applied to unmodified dependencies, Jaralyzer outperforms the current state-of-the-art code-centric scanner Eclipse Steady by detecting 28 more true vulnerabilities and yielding 29 fewer false warnings.
@inproceedings{abs-2510-19393,
title = {Bytecode-centric Detection of Known-to-be-vulnerable Dependencies in Java Projects},
author = {Stefan Schott and Serena Elisa Ponta and Wolfram Fischer and Jonas Klauke and Eric Bodden},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773151}
}