一句话：提出二进制到源码匹配方法B2SFinder，通过多代码特征与加权匹配精确检测COTS软件中的OSS复用。
COTS软件广泛复用开源软件（OSS），可能引入复用漏洞，因此需检测OSS复用。现有二进制到源码匹配方法虽可扩展到数万OSS项目，但支持的特征少、匹配分数粗略且忽略代码结构，精度不足。本文提出B2SFinder，支持七类在二进制与源码中均可追踪的代码特征，采用加权特征匹配算法，结合三种匹配方法与基于特征特异性和出现频率的加权方法，并依据匹配分数与OSS代码结构识别复用类型。作者在1000个COTS产品的21991个二进制及2189个候选OSS项目上评估，表明其兼具精度与可扩展性；相比现有技术发现的复用案例最多提高2.15倍，平均每二进制53.85秒，并讨论了漏洞检测应用。
COTS software products are developed extensively on top of OSS projects, resulting in OSS reuse vulnerabilities. To detect such vulnerabilities, finding OSS reuses in COTS software has become imperative. While scalable to tens of thousands of OSS projects, existing binary-to-source matching approaches are severely imprecise in analyzing COTS software products, since they support only a limited number of code features, compute matching scores only approximately in measuring OSS reuses, and neglect the code structures in OSS projects. We introduce a novel binary-to-source matching approach, called B2SFINDER1, to address these limitations. First of all, B2SFINDER can reason about seven kinds of code features that are traceable in both binary and source code. In order to compute matching scores precisely, B2SFINDER employs a weighted feature matching algorithm that combines three matching methods (for dealing with different code features) with two importance-weighting methods (for computing the weight of an instance of a code feature in a given COTS software application based on its specificity and occurrence frequency). Finally, B2SFINDER identifies different types of code reuses based on matching scores and code structures of OSS projects. We have implemented B2SFINDER using an optimized data structure. We have evaluated B2SFINDER using 21991 binaries from 1000 popular COTS software products and 2189 candidate OSS projects. Our experimental results show that B2SFINDER is not only precise but also scalable. Compared with the state ofthe art, B2SFINDER has successfully found up to 2.15× as many reuse cases in 53.85 seconds per binary file on average. We also discuss how B2SFINDER can be leveraged in detecting OSS reuse vulnerabilities in practice.
DOI 原文 ·
@inproceedings{paperbot5340,
title = {B2SFinder: Detecting Open-Source Software Reuse in COTS Software},
author = {Zimu Yuan and Muyue Feng and Feng Li and Gu Ban and Yang Xiao and Shiyang Wang and Qian Tang and He Su and Chendong Yu and Jiahuan Xu and Aihua Piao and Jingling Xuey and Wei Huo},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00100}
}