Detecting third-party libraries (TPLs) in C/C++ binaries is essential for software supply chain security, enabling vulnerability identification and license compliance. Existing methods predominantly rely on similarity matching: extracting features from binaries and comparing them against library databases. However, sim...
Cheng-Yue Liu, Zheng-Zi Xu, Lyuye Zhang et al.· Proceedings of the ACM on So...· 0 citations
Remediating vulnerabilities in open-source software (OSS) dependencies is vital to maintaining software supply chain security. However, current automated approaches almost exclusively rely on dependency upgrades, which is limited by the nature of upgrades, i.e., the availability of secure versions, version pinning, and...
Lyuye Zhang, He Ye, Federica Sarro et al.· 0 citations
As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit...
Lyuye Zhang, Chengwei Liu, Fang-Yuan Zhang et al.· 0 citations
The results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling.
Fang-Yuan Zhang, Lyuye Zhang, Lingling Fan et al.· 0 citations
This work presents Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework and identifies four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-...
Jin-Cheng Yang, Yu-Long Fu, Cheng-Wei Liu et al.· Proceedings of the 41st IEEE...· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
