一句话:提出首个自动生成特征的 JavaScript 前端库检测方法,用 pTree 结构识别打包器打包的库。
识别网页上运行的前端库十分困难。现有检测器虽然成熟,但存在误报,且无法检测由 Webpack 等打包器打包的库;其检测特征依赖开发者知识人工收集,流程低效,导致大量库无法被识别。本文提出 PTDETECTOR,首个自动生成特征并检测网页库的方法。作者设计了一种新的数据结构 pTree 作为检测特征,该结构适合自动化生成,并能克服现有检测器的局限。系统实现为浏览器扩展,并在 200 个高流量网站上测试。实验表明,PTDETECTOR 能够识别打包器打包的库,且检测结果优于现有工具。
Identifying what front-end library runs on a web page is challenging. Although many mature detectors exist on the market, they suffer from false positives and the inability to detect libraries bundled by packers such as Webpack. Most importantly, the detection features they use are collected from developers' knowledge leading to an inefficient manual workflow and a large number of libraries that the existing detectors cannot detect. This paper introduces PTDETECTOR, which provides the first automated method for generating features and detecting libraries on web pages. We propose a novel data structure, the pTree, which we use as a detection feature. The pTree is well-suited for automation and addresses the limitations of existing detectors. We implement PTDETECTOR as a browser extension and test it on 200 top-traffic websites. Our experiments show that PTDETECTOR can identify packer-bundled libraries, and its detection results outperform existing tools.