一句话：提出面向软件供应链的漏洞传播分析与动态影响评分方法，支持全生态、调用图级影响评估。
软件供应链漏洞影响评估需要确定影响范围与规模，但现有研究存在两点不足：一是在包级粗粒度分析导致大量误报，或无法完成全生态系统的漏洞传播分析；二是 CVSS 等指标只刻画单个漏洞，缺乏量化漏洞在供应链中动态传播影响的度量。本文提出两种方法：（i）基于分层工作表的算法，在调用图级别进行全生态系统漏洞传播分析；（ii）漏洞传播评分系统 VPSS，用于量化漏洞影响的范围与演化。作者在 Java Maven 生态实现原型，并在 100 个真实漏洞上评估。结果表明，该方法能有效支持生态范围的漏洞传播分析，并通过 VPSS 提供实用的定量影响度量。
Identifying the impact scope and scale is critical for software supply chain vulnerability assessment. However, existing studies face substantial limitations. First, prior studies either work at coarse package-level granularity—producing many false positives—or fail to accomplish whole-ecosystem vulnerability propagation analysis. Second, although vulnerability assessment indicators like CVSS characterize individual vulnerabilities, no metric exists to specifically quantify the dynamic impact of vulnerability propagation across software supply chains. To address these limitations and enable accurate and comprehensive vulnerability impact assessment, we propose a novel approach: (i) a hierarchical worklist-based algorithm for whole-ecosystem and call-graph-level vulnerability propagation analysis and (ii) the Vulnerability Propagation Scoring System (VPSS), a dynamic metric to quantify the scope and evolution of vulnerability impacts in software supply chains. We implement a prototype of our approach in the Java Maven ecosystem and evaluate it on 100 real-world vulnerabilities. Experimental results demonstrate that our approach enables effective ecosystem-wide vulnerability propagation analysis, and provides a practical, quantitative measure of vulnerability impact through VPSS.
DOI 原文 ·
@inproceedings{paperbot9487,
title = {Propagation-Based Vulnerability Impact Assessment for Software Supply Chains},
author = {Bonan Ruan and Zhiwei Lin and Jiahao Liu and Chuqi Zhang and Kaihang Ji and Zhenkai Liang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00014}
}