Abstract:

Nowadays, open source software is widely used in various industries, particularly in important fields such as aerospace and automotive electronics. However, most open source software has security vulnerabilities. In China, the component analysis and verification of open source software are seriously missing in software development and evaluation, which makes it difficult to ensure the safety of software in critical areas. Therefore, Software Component Analysis (SCA) is indispensable to ensure software security, and accurate identification of Third-Party Dependencies (TPD) is the key to software vulnerability management and compliance assessment. To solve these problems, this paper proposes a lightweight dependency analysis method for SCA, which improves the accuracy of TPD identification and efficiency of large-scale project file processing. The main contents are as follows: first, the method includes an analysis algorithm for the Java Maven project, which constructs the project structure model and extracts TPD information by identifying the construction configuration file of the project; second, the method includes a redundant dependency detection algorithm based on the Winnowing algorithm. The algorithm detects the actual use of TPD and eliminates redundant dependencies by comparing the code file and hash fingerprint that identifies TPD information step by step; third, based on the proposed algorithm, a lightweight component analysis framework is designed and implemented. The framework wraps the analysis algorithm through a specific analyzer class and then registers and executes the analysis task using the ServiceLoader API in Java. To verify the effectiveness of the method, database containing 56 870 different versions of TPD is built, and four real open source projects from GitHub for experimental verification are collected. The results show that the proposed algorithm performs well in terms of detection accuracy. Compared with the clustering algorithm based on machine learning and technology based on code similarity comparison, the proposed algorithm has higher accuracy, F1 value, and lower detection time. In addition, the ServiceLoader API applied to the system makes it more extensible, convenient for adding different analysis algorithms, and has strong practicability, laying the foundation for the subsequent implementation of multilingual TPD detection.

Key words: Software Component Analysis (SCA), dependency detection, Java language, Maven tool, software system

摘要：

开源软件在各个行业, 尤其是在航空航天、汽车电子等关键领域广泛应用, 但大部分开源软件存在安全漏洞。在我国, 开源软件的成分分析和验证在软件开发及评测中严重缺失, 导致关键领域软件安全难以保障。因此, 软件成分分析(SCA)对确保软件安全不可或缺, 其中, 准确的第三方依赖项(TPD)识别是软件漏洞管理与合规性评估的关键。针对上述问题, 提出一种面向SCA的轻量化依赖分析方法, 提高了TPD识别的准确性和大规模项目文件处理的效率。1)该方法包含一种针对Java语言Maven项目的分析算法, 算法通过识别项目的构建配置文件, 构建项目结构模型并提取TPD信息; 2)该方法包含一种基于Winnowing算法的冗余依赖检测算法, 通过分步对比代码文件与识别到TPD信息的哈希指纹, 检测TPD的实际使用情况, 排除冗余依赖项; 3)基于提出的算法, 设计并实现了一种轻量化的成分分析框架, 该框架通过特定的分析器类包装分析算法, 使用Java中的ServiceLoader API注册并执行分析任务。为了验证所提方法的有效性, 构建一个包含56 870个不同版本TPD的数据库, 并从GitHub收集了4个真实的开源项目进行实验验证, 实验结果表明, 所提算法在检测准确度上表现出色, 与基于机器学习的聚类算法和基于代码相似性比较的技术相比, 所提算法有更高的准确率、F1值, 更低的检测耗时。另外, 该系统应用的ServiceLoader API使得系统有较强的拓展性, 便于增加不同的分析算法, 有较强的实用性, 为后续实现多语言TPD检测工作奠定基础。

关键词: 软件成分分析, 依赖检测, Java语言, Maven工具, 软件系统