一句话：提出属性顺序图（POG）与函数级指纹，静态检测打包代码中的 JS 库及其版本。
在 Web 应用中识别前端 JavaScript 库对网站画像、漏洞检测与依赖管理至关重要。但 Webpack 等打包器会以多种方式转译代码，破坏原有目录与代码结构，使库检测变得困难。现有最优方法依赖运行时的属性模式匹配，存在两点不足：无法检测不能从全局对象访问的库，且版本识别粒度受限。本文提出 Debun，一种基于函数级指纹的可扩展库与版本检测技术。其核心洞察是：即使经过转译，打包器仍保留属性名以及属性操作的执行顺序。据此作者定义属性顺序图（POG），用以刻画函数体内属性操作的执行次序，并以此进行库指纹匹配与版本判定。在 68 个高流量网站、78 个前端库上的评估显示，Debun 的库检测 F1 达 91.76%（为现有工具的 1.39 倍），版本识别（包含匹配）F1 达 79.81%（1.36 倍），优于现有工具。
Detecting front-end JavaScript libraries in web applications is essential for website profiling, vulnerability detection, and dependency management. However, bundlers like Webpack transpile code in various ways, altering the original directory and code structure, which complicates library detection. While state-of-the-art techniques utilize property pattern-based library detection at runtime, they face two key limitations: (1) they cannot detect libraries inaccessible from the global object, and (2) they have limitations in granular version detection. To address these challenges, we present Debun, a scalable technique for detecting JavaScript libraries and their versions using function-level fingerprints. Our key insight is that bundlers preserve the property names and execution order of property operations, even after transpilation. To leverage this, we introduce the property-order graph (POG), which represents the execution order of property operations within a function body. We evaluate Debun on 68 high-traffic websites with 78 front-end JavaScript libraries. Our approach outperforms existing tools, achieving a 91.76% F1-score in library detection (1.39x higher) and an 79.81% F1-score in version identification with inclusion match (1.36x higher).
DOI 原文 ·
@inproceedings{paperbot9260,
title = {Debun: Detecting Bundled JavaScript Libraries on Web using Property-Order Graphs},
author = {Seojin Kim and Sungmin Park and Jihyeok Park},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00015}
}