Blogs (1) >>
ASE 2019
Sun 10 - Fri 15 November 2019 San Diego, California, United States
Thu 14 Nov 2019 17:00 - 17:20 at Cortez 2&3 - Untangling and Merging Chair(s): Iftekhar Ahmed

COTS software products are widely developed on top of one or more OSS projects, which might lead to OSS reuse vulnerabilities. To discover such vulnerabilities, detecting OSS reuses for COTS software is a necessary step. Existing binary-to-source matching approaches are scalable to tens of thousands of OSS projects. However, when applying to COTS software products, they are suffering from precision problem severely due to their limited code features, imprecise matching score computation and the neglect of code structure of OSS projects. In this paper, we propose a novel binary-to-source matching approach B2SFinder to address these issues. It fully analyzes and selects seven kinds of code features that are presented in both binary file and source code and are not susceptible to compilation. In order to precisely calculate matching scores, it employs a weighted feature matching algorithm that combines three matching methods with two importance-weight computing algorithms. The matching methods are applied to different features according to the representation form of the features. The weighting algorithms compute the weight of a feature instance considering its specificity and occurrence frequency. B2SFinder further identifies the reuse type based on matching scores and code structures of OSS projects. We have implemented a prototype of B2SFinder with optimized data structure. We evaluated it on 21991 binaries of 1000 popular COTS software products. The results showed that it is not only precise but also scalable. It identified up to 2.15 times as many reuse cases as the state-of-the-art approach while only took 53.85 seconds on average for a binary file. It also plays a major role in discovering OSS reuse vulnerabilities.

Thu 14 Nov

Displayed time zone: Tijuana, Baja California change

16:00 - 17:40
Untangling and MergingResearch Papers at Cortez 2&3
Chair(s): Iftekhar Ahmed University of California at Irvine, USA
16:00
20m
Talk
The Impact of Structure on Software Merging: Semistructured versus Structured Merge
Research Papers
Guilherme Cavalcanti Federal University of Pernambuco, Brazil, Paulo Borba Federal University of Pernambuco, Brazil, Georg Seibt University of Passau, Sven Apel Saarland University
Pre-print
16:20
20m
Talk
Semistructured Merge in JavaScript Systems
Research Papers
Alberto Trindade Tavares Federal University of Pernambuco, Paulo Borba Federal University of Pernambuco, Brazil, Guilherme Cavalcanti Federal University of Pernambuco, Brazil, Sergio Soares Federal University of Pernambuco
Pre-print
16:40
20m
Talk
CLCDSA: Cross Language Code Clone Detection using Syntactical Features and API Documentation
Research Papers
Kawser Nafi University of Saskatchewan, Tonny Shekha Kar University of Saskatchewan, Canada, Banani Roy University of Saskatchewan, Chanchal K. Roy University of Saskatchewan, Kevin Schneider University of Saskatchewan
17:00
20m
Talk
B2SFinder: Detecting Open-Source Software Reuse in COTS Software
Research Papers
Muyue Feng Institute of Information Engineering, Chinese Academy of Sciences, Zimu Yuan Institute of Information Engineering, Chinese Academy of Sciences, Feng Li Institute of Computing Technology at Chinese Academy of Sciences, China, Gu Ban Institute of Information Engineering, Chinese Academy of Sciences, Yang Xiao Institute of Information Engineering, Chinese Academy of Sciences & School of Cyber Security, University of Chinese Academy of Sciences, Shiyang Wang Institute of Information Engineering, Chinese Academy of Sciences, Qian Tang Institute of Information Engineering, Chinese Academy of Sciences, He Su Institute of Information Engineering, Chinese Academy of Sciences, Chendong Yu University of Chinese Academy of Sciences, Jiahuan Xu Institute of Information Engineering, Chinese Academy of Sciences, Aihua Piao Institute of Information Engineering, Chinese Academy of Sciences, Jingling Xue UNSW Sydney, Wei Huo Institute of Information Engineering, Chinese Academy of Sciences
17:20
20m
Talk
CoRA: Decomposing and Describing Tangled Code Changes for Reviewer
Research Papers
Min Wang Peking University, Zeqi Lin Microsoft Research, China, Yanzhen Zou Peking University, Bing Xie Peking University