一句话：提出首个无数据库SCA框架，用LLM模拟安全分析师从开放互联网检索证据来识别第三方库复用。
现代软件开发广泛使用第三方库（TPL），带来安全与合规风险，因此需要软件成分分析（SCA）。但传统SCA依赖维护成本高昂的特征数据库，在开源生态膨胀和大模型融入开发的背景下难以为继。本文借鉴LLM应用在外部数据交互上的演进，提出首个无数据库SCA框架：不依赖重型数据库，而利用LLM模拟安全分析师的人工分析，通过开放互联网检索相同证据并确认TPL身份。实验覆盖Android原生库识别与C/C++基于复制的TPL复用两个典型场景，尤其针对未被充分关注的构件，展示了无数据库策略在SCA中的可行前景。
The prevalent use of third-party libraries (TPLs) in modern software development introduces significant security and compliance risks, necessitating the implementation of Software Composition Analysis (SCA) to manage these threats. However, the accuracy of SCA tools heavily relies on the quality of the integrated feature database to cross-reference with user projects. While under the circumstance of the exponentially growing of open-source ecosystems and the integration of large models into software development, it becomes even more challenging to maintain a comprehensive feature database for potential TPLs. To this end, after referring to the evolution of LLM applications in terms of external data interactions, we propose the first framework of DB-Less SCA, to get rid of the traditional heavy database and embrace the flexibility of LLMs to mimic the manual analysis of security analysts to retrieve identical evidence and confirm the identity of TPLs by supportive information from the open Internet. Our experiments on two typical scenarios, native library identification for Android and copy-based TPL reuse for C/C++, especially on artifacts that are not that underappreciated, have demonstrated the favorable future for implementing database-less strategies in SCA.
@inproceedings{paperbot9043,
title = {Drop the Golden Apples: Identifying Third-Party Reuse by DB-Less Software Composition Analysis},
author = {Lyuye Zhang and Chengwei Liu and Jiahui Wu and Shiyang Zhang and Chengyue Liu and Zhengzi Xu and Sen Chen and Yang Liu},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728525}
}