Software Supply Chain Analysis Based on Function Similarity. (August 2020)

• Record Type: Journal Article
• Authors: Sun, Wenjie; Shan, Zheng; Liu, Fudong; Li, Xingwei; Qiao, Meng; Zhang, Chunyan
• Is Part Of: Journal of physics. Volume 1601:Number 5(2020)
• Publication Date: 2020-08
• Subjects: Physics -- Congresses; 530.5
• DOI: 10.1088/1742-6596/1601/5/052020
• Languages: English
• ISSNs: 1742-6588

Abstract

Abstract: The supply of open source and open source components is growing at an alarming rate, while vulnerabilities in open source components are everywhere. Software supply chain analysis aims to discover third-party components and open source code used in a software, and analyze the software's dependence on components. In this paper, we propose a software component analysis method and a known vulnerabilities detecting method. By scanning the open source components of the binary file and conducting vulnerability analysis, the known vulnerabilities are detected. This paper mainly solves the problem of detecting known vulnerabilities in the supply chain of binary files. We conducted a case analysis and achieved good results.