一句话：构建大规模数据集评估 C/C++ 第三方库依赖检测，并提出 TPLite 显著提升 SCA 精度与召回。
现有 C/C++ 软件成分分析（SCA）通过特征匹配识别复用组件，但内部代码克隆造成的特征重复会降低准确性。Centris 采用函数级代码克隆检测推导第三方库（TPL）依赖以消除冗余特征，但其依赖推导精度尚未评估，且评测数据有限。本文构建两个大规模真值数据集，分别评估 TPL 依赖推导与 SCA 结果；发现 Centris 泛化不佳，归因于函数诞生时间不准和基于阈值的召回，且对 SCA 影响有限。为此提出 TPLite，结合函数级来源 TPL 检测与图依赖召回。实验表明，相比 Centris，TPLite 将 TPL 依赖推导精度从 35.71% 提升至 88.33%、召回从 49.44% 提升至 62.65%；相比 B2SFinder 和 BDBA 也取得更优结果。
Existing software composition analysis (SCA) techniques for the C/C++ ecosystem tend to identify the reused components through feature matching between target software project and collected third-party libraries (TPLs). However, feature duplication caused by internal code clone can cause inaccurate SCA results. To mitigate this issue, Centris, a state-of-the-art SCA technique for the C/C++ ecosystem, was proposed to adopt function-level code clone detection to derive the TPL dependencies for eliminating the redundant features before performing SCA tasks. Although Centris has been shown effective in the original paper, the accuracy of the derived TPL dependencies is not evaluated. Additionally, the dataset to evaluate the impact of TPL dependency on SCA is limited. To further investigate the efficacy and limitations of Centris, we first construct two large-scale ground-truth datasets for evaluating the accuracy of deriving TPL dependency and SCA results respectively. Then we extensively evaluate Centris where the evaluation results suggest that the accuracy of TPL dependencies derived by Centris may not well generalize to our evaluation dataset. We further infer the key factors that degrade the performance can be the inaccurate function birth time and the threshold-based recall. In addition, the impact on SCA from the TPL dependencies derived by Centris can be somewhat limited. Inspired by our findings, we propose TPLite with function-level origin TPL detection and graph-based dependency recall to enhance the accuracy of TPL reuse detection in the C/C++ ecosystem. Our evaluation results indicate that TPLite effectively increases the precision from 35.71% to 88.33% and the recall from 49.44% to 62.65% of deriving TPL dependencies compared with Centris. Moreover, TPLite increases the precision from 21.08% to 75.90% and the recall from 57.62% to 64.17% compared with the SOTA academic SCA tool B2SFinder and even outperforms the well-adopted commercial SCA tool BDBA, i.e., increasing the precision from 72.46% to 75.90% and the recall from 58.55% to 64.17%.
@inproceedings{JiangY0NWZ23,
title = {Third-Party Library Dependency for Large-Scale SCA in the C/C++ Ecosystem: How Far Are We?},
author = {Ling Jiang and Hengchen Yuan and Qiyi Tang and Sen Nie and Shi Wu and Yuqun Zhang},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598143}
}