一句话：提出JDetect，融合代码与开发者行为特征，实现Java源码OSS复用组件的细粒度检测与提交级追踪。
开源复用关系识别是软件供应链管理的前提，源码软件成分分析（SSCA）通过分析仓库源码来发现此类关系。但现有SSCA方法缺乏针对Java语言的工业验证，常依赖单一版本特征并忽略开发者集成习惯，导致检测鲁棒性差、可追溯性有限。为此，本文提出JDetect，一种融合行为特征与代码特征的Java SSCA方法。JDetect从开源函数中提取多维代码特征以构建组件数据库，并结合哈希指纹、向量排序与开发者行为模式，检测复用组件并在commit级别进行追踪。在真实工业Java项目上的实验表明，JDetect识别OSS组件的F1值为85.41%，较基线提升约10%；在OSS追踪任务中，97.47%的识别组件可被追踪到最优位置；平均每个仓库检测时间为66.74秒。
Accurate identification of open-source software (OSS) reuse relationships is a prerequisite for effective software supply chain management. Source software composition analysis (SSCA) techniques analyze repository source code to identify such relationships. However, existing SSCA methods lack industrial validation for the Java language. They typically rely on single version-based features, and neglect developers' integration habits. These limitations lead to poor detection robustness and limited traceability. To address these issues, we propose JDetect, a Java SSCA method that fuses behavioral and code features for fine-grained traceability. JDetect extracts multi-dimensional code features from OSS functions to construct a component database. JDetect combines hash fingerprints, vector sorting, and developer behavior patterns to detect reused components and trace them at the commit level. Experimental results on real-world industrial Java projects show that JDetect achieves an F1 score of 85.41% in OSS component identification, representing an improvement of approximately 10% over the baseline. In the OSS tracking task, 97.47% of the identified components are traced to their optimal locations. In addition, JDetect demonstrates high efficiency, with an average detection time of 66.74 seconds per repository. Overall, JDetect provides a precise and efficient SSCA solution for managing software supply chains in industrial settings.
@inproceedings{FanLCYWS26,
title = {JDetect: A Fine-Grained Detecting Method for Java Source SCA by Fusing Behavioral and Code Features},
author = {Guisheng Fan and Shulin Liu and Wentao Chen and Huiqun Yu and Huan Wang and Diwen Shi},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805233}
}