一句话：提出二进制第三方库检测工具OSLDetector，通过特征匹配与内部克隆森林应对特征重复，并识别许可证冲突与漏洞。
使用开源库虽能提供丰富功能并降低开发成本，但也带来许可证冲突和漏洞风险等关键问题。本文设计并实现了面向二进制多平台软件的开源库检测工具 OSLDetector，采用特征匹配方法检测第三方库，并通过特征过滤和构建内部克隆森林等方法来应对特征重复带来的挑战。该工具还能给出许可证冲突并识别可能对应的漏洞，从而帮助解决和规避潜在风险。为评估 OSLDetector 的效率，作者收集了 5K 个库、9K 个版本，并管理其许可证类型和已有漏洞。实验结果显示，其精确率为 96%，召回率为 92.3%，表明 OSLDetector 有效且优于同类工具。
Using open-source libraries can provide rich functions and reduce development cost. However, some critical issues have also been caused such as license conflicts and vulnerability risks. In this paper, we design and implement an open-source libraries detection tool OSLDetector which uses methods of matching features to detect third-party libraries for multi-platform software in binaries. We took a series of methods such as filtering features and novelty building an internal clone forest to cope with the challenge of feature duplication. The tool can also provide the conflict of licenses and identify possible corresponding vulnerabilities, so these potential risks can be resolved and avoided. To evaluate the efficiency of OSLDetector, we collect 5K libraries containing 9K versions and manage their respective license type and existing vulnerabilities. The experimental results with a precision of 96% and recall of 92.3% show that OSLDetector is effective and outperforms similar tools.