Finally, we show how B2SMatcher can be used to evaluate real-world software and find some security risks in practice.ĭuring the modern software development process, developers often use the rich functions provided by open source software (OSS) to shorten the development cycle, spending more time on personalized development. The result shows that B2SMatcher achieves a high precision up to 89.2% and outperforms state-of-the-art tools. We have evaluated B2SMatcher using 6351 candidate OSS versions and 585 binaries. In order to extract source code features as accurately as possible, B2SMatcher innovatively uses machine learning methods to obtain the source files involved in the compilation and uses function abstraction and normalization methods to eliminate the comparison costs on redundant functions across versions. B2SMatcher also identifies different types of OSS version reuse based on matching scores and matched feature instances. We categorize these features into program-level features and function-level features and propose a two-stage version identification approach based on the two levels of code features. We first discuss five kinds of version-sensitive code features that are trackable in both binary and source code. The features they selected are not distinguishable enough for version detection and the matching scores are only based on similarity.This paper presents B2SMatcher, a fine-grained version identification tool for OSS in commercial off-the-shelf (COTS) software.

Existing state-of-the-art OSS reuse detection work can not identify the specific versions of reused OSS well. However, reusing some specific versions of OSS introduces 1-day vulnerabilities of which details are publicly available, which may be exploited and lead to serious security issues. Codes of Open Source Software (OSS) are widely reused during software development nowadays.

Files not associated with matlab 2018b