Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities
Abstract
Software composition analysis (SCA) tools have been widely adopted to identify vulnerable libraries used in software applications. Such SCA tools depend on a vulnerability database to know affected libraries of each vulnerability. However, it is labor-intensive and error prone for a security team to manually maintain the vulnerability database. While several approaches adopt extreme multi-label learning to predict affected libraries for vulnerabilities, they are practically ineffective due to the limited library labels and the unawareness of ecosystems.
BibTeX
@inproceedings{Wu-al:ICSE24,
author = {Susheng Wu and
Wenyan Song and
Kaifeng Huang and
Bihuan Chen and
Xin Peng},
title = {Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities},
booktitle = {ICSE},
pages = {162:1--162:12},
publisher = {{ACM}},
year = {2024},
}