2021/02/11 by Seunghoon Woo, Sung-Han Park, Woo, Seunghoon +7 · 5 citations
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Software Engineering (cs.SE) #Software Engineering Research
paper · pdf · doi:10.48550/arxiv.2102.06182
openalex publication_date 2021/02/11 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
Open-source software (OSS) is widely reused as it provides convenience and\nefficiency in software development. Despite evident benefits, unmanaged OSS\ncomponents can introduce threats, such as vulnerability propagation and license\nviolation. Unfortunately, however, identifying reused OSS components is a\nchallenge as the reused OSS is predominantly modified and nested. In this\npaper, we propose CENTRIS, a precise and scalable approach for identifying\nmodified OSS reuse. By segmenting an OSS code base and detecting the reuse of a\nunique part of the OSS only, CENTRIS is capable of precisely identifying\nmodified OSS reuse in the presence of nested OSS components. For scalability,\nCENTRIS eliminates redundant code comparisons and accelerates the search using\nhash functions. When we applied CENTRIS on 10,241 widely-employed GitHub\nprojects, comprising 229,326 versions and 80 billion lines of code, we observed\nthat modified OSS reuse is a norm in software development, occurring 20 times\nmore frequently than exact reuse. Nonetheless, CENTRIS identified reused OSS\ncomponents with 91% precision and 94% recall in less than a minute per\napplication on average, whereas a recent clone detection technique, which does\nnot take into account modified and nested OSS reuse, hardly reached 10%\nprecision and 40% recall.\n