一句话：提出GANADI，通过关键函数聚类与复用方向推断构建C/C++ OSS复用谱系，提升供应链安全与漏洞管理。
现有方法虽能识别项目内复用的开源组件及其漏洞，却无法追踪经过中间项目的复用路径，限制了供应链安全分析与SBOM完整性。本文提出GANADI，通过聚类共享源派生代码特征（称为关键函数）的下游项目，并推断同一簇内项目间的复用方向，系统性地构建C/C++ OSS复用谱系。作者在20个被广泛复用的OSS项目、超过1500条传播路径上进行评估，GANADI达到84.85%的精度和95.76%的召回率，显著优于现有方法最高23.21%的召回率。进一步利用所构建的复用谱系进行漏洞检测，在真实热门C/C++项目中识别出48个未修补漏洞，其中23个经负责任披露后已被修补，包括一个获得CVE编号的漏洞，证明了基于谱系的漏洞管理具有实际影响。
We present GANADI, a systematic approach for identifying C/C++ OSS reuse genealogies to enhance software supply chain security. Understanding OSS reuse genealogy is crucial for improving SBOM completeness and prioritizing security remediation across supply chains. Although existing approaches can identify reused components and vulnerabilities within a project, they fail to trace OSS reuse paths through intermediate projects, limiting their effectiveness in securing supply chain ecosystems. To address this limitation, GANADI constructs reuse genealogies by clustering downstream projects based on shared characteristics of origin-derived code (called pivotal functions), and then inferring reuse direction among the projects within each cluster. When applied to 20 widely reused OSS projects with over 1,500 propagation paths, GANADI achieved 84.85% precision and 95.76% recall in identifying reuse genealogies, outperforming existing approaches that achieved at most 23.21% recall. Leveraging OSS reuse genealogy for vulnerability detection, we identified 48 unpatched vulnerabilities in real-world popular C/C++ projects. Among them, 23 were patched following our responsible disclosure (including one CVE ID assigned), demonstrating the practical impact of genealogy-based vulnerability management.
@inproceedings{paperbot12226,
title = {GANADI: Uncovering C/C++ OSS Reuse Genealogies via Pivotal Function-Based Clustering to Enhance Supply Chain Security},
author = {Dongyeon Kim and Seunghoon Woo and Heejo Lee},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837498}
}