LibvDiff: Library Version Difference Guided OSS Version Identification in Binaries
Abstract
Open-source software (OSS) has been extensively employed to expedite software development, inevitably exposing downstream software to the peril of potential vulnerabilities. Precisely identifying the version of OSS not only facilitates the detection of vulnerabilities associated with it but also enables timely alerts upon the release of 1-day vulnerabilities. However, current methods for identifying OSS versions rely heavily on version strings or constant features, which may not be present in compiled OSS binaries or may not be representative when only function code changes are made. As a result, these methods are often imprecise in identifying the version of OSS binaries being used.
BibTeX
@inproceedings{Dong-al:ICSE24,
author = {Chaopeng Dong and
Siyuan Li and
Shouguo Yang and
Yang Xiao and
Yongpan Wang and
Hong Li and
Zhi Li and
Limin Sun},
title = {{LibvDiff:} Library Version Difference Guided {OSS} Version Identification in Binaries},
booktitle = {ICSE},
pages = {66:1--66:12},
publisher = {{ACM}},
year = {2024},
}