TPLaser: a method for precise detection and version identification of TPL based on multi-level filtering

Abstract

Third-party libraries (TPLs) are widely used in software development due to their advantages such as providing reusable components, shortening development cycles, and reducing costs. However, the extensive use of TPLs also introduce security risks: outdated or untimely updated TPLs often contain known vulnerabilities. Software Composition Analysis (SCA) is an important method to identify and supervise the use of TPL in program projects. However, the existing methods have some problems, such as that reuse determination relies on the proportion of matched reused functions, the difficulty in identifying partial reuse and the inaccurate version judgment. Therefore, we propose TPLaser, a multi-level filtering-based approach for precise TPL detection and version identification, aiming to achieve high-precision detection of reused TPLs and their versions in source code programs. TPLaser first constructs a TPL library covering 26,551 open-source projects and 722,024 versions. Then, it sequentially identifies and filters cloned functions, supporting functions, and common functions to extract a core function set that constitutes the unique fingerprint of the TPL; finally, it utilizes these highly discriminative core function features for precise matching against the target program code, and combines version evolution graph to identify TPL version information. Compared with existing advanced tools, TPL detection achieves accuracy and recall rates of 88.85% and 90.20%, respectively. In TPL version detection, TPLaser also demonstrates high accuracy (82.10%).

Graphical abstract

Keywords

Software composition analysis / third-party library / software security

References

[1] Synopsys. 2026 Open source security and risk analysis report. See blackduck.com/resources/analyst-reports/open-source-security-risk-analysis website, 2026

[2] Zhao B, Ji S, Xu J, Tian Y, Wei Q, Wang Q, Lyu C, Zhang X, Lin C, Wu J, Beyah R. A large-scale empirical analysis of the vulnerabilities introduced by third-party components in IoT firmware. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. 2022, 442–454

[3] Synopsys. See synopsys.com/zh-cn website, 2025

[4] Tencent. Iot terminal security white paper. See cloud.tencent.com.cn/developer/article/1799052 website, 2021

[5] Zhan L, Ming J, Fu J, Peng G, Sha L, Lan L . The hidden complexities of android TPL detection: an empirical analysis of techniques, challenges, and effectiveness. Computers & Security, 2025, 159: 104672

[6] Duan R, Bijlani A, Xu M, Kim T, Lee W. Identifying open-source license violation and 1-day security risk at large scale. In: Proceedings of 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017, 2169–2185

[7] Xu J, Yuan Q T . LibPass: third-party library detection method based on package structure and signature. Journal of Software, 2024, 35( 6): 2880–2902

[8] Sajnani H, Saini V, Svajlenko J, Roy C K, Lopes C V. SourcererCC: scaling code clone detection to big-code. In: Proceedings of the 38th International Conference on Software Engineering. 2016, 1157–1168

[9] Lopes C V, Maj P, Martins P, Saini V, Yang D, Zitny J, Sajnani H, Vitek J . DéjàVu: a map of code duplicates on GitHub. Proceedings of the ACM on Programming Languages, 2017, 1( OOPSLA): 84

[10] Woo S, Park S, Kim S, Lee H, Oh H. Centris: a precise and scalable approach for identifying modified open-source software reuse. In: Proceedings of the 43rd IEEE/ACM International Conference on Software Engineering (ICSE). 2021, 860–872

[11] Hai X, Zeng J, Fu Z, Chen S, Shi Y, Sun H, Wang J, He F, Zhang Y. OSSDetector: towards a more accurate approach for C/C++ third-party library detection. In: Proceedings of the 24th IEEE International Conference on Trust, Security and Privacy in Computing and Communications. 2025, 2433–2438

[12] Wu J, Xu Z, Tang W, Zhang L, Wu Y, Liu C, Sun K, Zhao L, Liu Y. OSSFP: precise and scalable C/C++ third-party library detection using fingerprinting functions. In: Proceedings of the 45th IEEE/ACM International Conference on Software Engineering (ICSE). 2023, 270–282

[13] Woo S, Choi E, Lee H, Oh H. V1SCAN: discovering 1-day vulnerabilities in reused C/C++ open-source software components using code classification techniques. In: Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23). 2023, 366

[14] Google . filament. See github.com/google/filament website, 2025

[15] Bernstein D J. Tweetnac. See tweetnacl.cr.yp.to/ website, 2017

[16] Ning Y, Zhang Y, Ma C, Guo Z, Yu L . Empirical study of software composition analysis tools for C/C++ binary programs. IEEE Access, 2024, 12: 50418–50430

[17] GitHub. See github.com/ website, 2025

[18] GitHub. universal-ctags. See github.com/universal-ctags/ctags website, 2022

[19] Git. See git-scm.com/?hl=zh-cn website, 2014

[20] Mukherjee P, Kesharwani A, Dua J, Pandey S K. Code reuse and sustainable testing-a comparative survey and study. In: Proceedings of 2023 International Conference on Artificial Intelligence and Smart Communication (AISC). 2023, 715–721

[21] dspinellis. tokenizer. See github.com/dspinellis/tokenizer website, 2019

[22] Weber T, Brandmaier M, Schmidt A, Mayer S . Significant productivity gains through programming with large language models. Proceedings of the ACM on Human-Computer Interaction, 2024, 8( EICS): 256

[23] Microsoft. Code metrics values. See learn.microsoft.com/zh-cn/previous-versions/visualstudio/visual-studio-2015/code-quality/code-metrics-values?view=vs-2015&redirectedfrom=MSDN website, 2016

[24] IBM. Maintainability index report. See ibm.com/docs/en/addi/6.1.3?topic=reports-maintainability-index-report website, 2025

[25] Pal S, Sillitti A . Cross-project defect prediction: a literature review. IEEE Access, 2022, 10: 118697–118717

[26] Zhao W X, Liu J, Ren R, Wen J R . Dense text retrieval based on pretrained language models: a survey. ACM Transactions on Information Systems, 2024, 42( 4): 89

[27] MySQL. See mysql.com/cn website, 2026

[28] Ushakov R, Doynikova E, Novikova E, Kotenko I. CPE and CVE based technique for software security risk assessment. In: Proceedings of the 11th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS). 2021, 353–356

[29] Costa L D F. Further generalizations of the Jaccard index. 2021, arXiv preprint arXiv: 2110.09619

[30] google. snappy. See github.com/google/snappy website, 2025

[31] arangodb. arangodb. See github.com/arangodb/arangodb website, 2025

[32] Zhan X, Fan L, Chen S, We F, Liu T, Luo X, Liu Y. ATVHunter: reliable version detection of third-party libraries for vulnerability identification in android applications. In: Proceedings of 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). 2021, 1695–1707

[33] Wu Y, Sun C, Zeng D, Tan G, Ma S, Wang P. LibScan: towards more precise Third-Party library identification for android applications. In: Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23). 2023, 190

[34] Jiang L, Yuan H, Tang Q, Nie S, Wu S, Zhang Y. Third-party library dependency for large-scale SCA in the C/C++ ecosystem: how far are we?. In: Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis. 2023, 1383–1395

[35] Zou Y, Zhang Y, Zhao G, Wu Y, Shen S, Fu C . BinCoFer: three-stage purification for effective C/C++ binary third-party library detection. Journal of Systems and Software, 2025, 229: 112480

[36] ssdeep Project. ssdeep. See ssdeep-project.github.io/ssdeep/index website, 2018

[37] Choi Y, Woo S. Tiver: identifying adaptive versions of C/C++ third-party open-source components using a code clustering technique. In: Proceedings of the 47th IEEE/ACM International Conference on Software Engineering (ICSE). 2025, 2458–2469

[38] anyrtcIO-Community. anyRTC-RTMP-OpenSource issue #167. See github.com/anyrtcIO-Community/anyRTC-RTMP-OpenSource/issues website, 2025

[39] Ragkhitwetsagul C, Krinke J. Using compilation/decompilation to enhance clone detection. In: Proceedings of the 11th IEEE International Workshop on Software Clones (IWSC). 2017, 1–7

[40] Kim S, Woo S, Lee H, Oh H. VUDDY: a scalable approach for vulnerable code clone discovery. In: Proceedings of 2017 IEEE Symposium on Security and Privacy (SP). 2017, 595–614

[41] Nakagawa T, Higo Y, Kusumoto S. NIL: large-scale detection of large-variance clones. In: Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2021, 830–841

[42] Alon U, Zilberstein M, Levy O, Yahav E . code2vec: learning distributed representations of code. Proceedings of the ACM on Programming Languages, 2019, 3( POPL): 40

[43] Alon U, Brody S, Levy O, Yahav E. code2seq: generating sequences from structured representations of code. In: Proceedings of the 7th International Conference on Learning Representations. 2019

[44] Verma A, Udhayanan P, Shankar R M, KN N, Chakrabarti S K. Source-code similarity measurement: syntax tree fingerprinting for automated evaluation. In: Proceedings of the 1st International Conference on AI-ML Systems. 2021, 8

[45] Marastoni N, Continella A, Quarta D, Zanero S, Preda M D. GroupDroid: automatically grouping mobile malware by extracting code similarities. In: Proceedings of the 7th Software Security, Protection, and Reverse Engineering/Software Security and Protection Workshop. 2017, 1

[46] Dong Y, Tang Y, Cheng X, Yang Y, Wang S . SedSVD: statement-level software vulnerability detection based on relational graph convolutional network with subgraph embedding. Information and Software Technology, 2023, 158: 107168

[47] Chochlov M, Aftab Ahmed G, Vincent Patten J, Lu G, Hou W, Gregg D, Buckley J. Using a nearest-neighbour, BERT-based approach for scalable clone detection. In: Proceedings of 2022 IEEE International Conference on Software Maintenance and Evolution (ICSME). 2022, 582–591

[48] Kartal Y, Akdeniz E K, Özkan K . Automating modern code review processes with code similarity measurement. Information and Software Technology, 2024, 173: 107490

[49] Li G, Liu H, Jiang Y, Jin J . Test-based clone detection: an initial try on semantically equivalent methods. IEEE Access, 2018, 6: 77643

[50] Leone F, Takada S. Towards overcoming type limitations in semantic clone detection. In: Proceedings of the 16th IEEE International Workshop on Software Clones (IWSC). 2022, 25–31

[51] SohC, Kuan Tan H B, Arnatovich Y L, Narayanan A, Wang L. LibSift: automated detection of third-party libraries in android applications. In: Proceedings of the 23rd Asia-Pacific Software Engineering Conference (APSEC). 2016, 41–48

[52] Zhang Y, Dai J, Zhang X, Huang S, Yang Z, Yang M, Chen H. Detecting third-party libraries in android applications with high precision and recall. In: Proceedings of the 25th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). 2018, 141–152

[53] Xu J, Yuan Q . LibRoad: rapid, online, and accurate detection of TPLs on android. IEEE Transactions on Mobile Computing, 2022, 21( 1): 167–180

[54] Zhang Z, Luo S, Lu Y, Pan L . Obfuscation-resilient detection of android third-party libraries using multi-scale code dependency fusion. Information Fusion, 2025, 117: 102908

[55] Xu S, Dong J, Cai W, Li J, Shaghaghi A, Sun N, Ma S. Enhancing security in third-party library reuse–comprehensive detection of 1-day vulnerability through code patch analysis. In: Proceedings of the 32nd Annual Network and Distributed System Security Symposium. 2025

[56] Tang W, Wang Y, Zhang H, Han S, Luo P, Zhang D. LibDB: an effective and efficient framework for detecting third-party libraries in binaries. In: Proceedings of the 19th International Conference on Mining Software Repositories. 2022, 423–434

[57] Cheng Y, Yang S, Lang Z, Shi Z, Sun L . VERI: a large-scale open-source components vulnerability detection in IoT firmware. Computers & Security, 2023, 126: 103068

[58] Jiang L, An J, Huang H, Tang Q, Nie S, Wu S, Zhang Y. BinaryAI: binary software composition analysis via intelligent binary source code matching. In: Proceedings of the 46th IEEE/ACM International Conference on Software Engineering. 2024, 224

[59] Yu W, Li S, Huang M, Li M, Xi R, Zhu H. LibRI: a module analysis framework for identifying complex reuse relationship in binaries. In: Proceedings of the 28th International Conference on Computer Supported Cooperative Work in Design (CSCWD). 2025, 2139–2144

[60] Ma Z, Wang H, Guo Y, Chen X. LibRadar: fast and accurate detection of third-party libraries in android apps. In: Proceedings of the 38th International Conference on Software Engineering Companion. 2016, 653–656

[61] Li M, Wang W, Wang P, Wang S, Wu D, Liu J, Xue R, Huo W. LibD: scalable and precise third-party library detection in android markets. In: Proceedings of the 39th IEEE/ACM International Conference on Software Engineering (ICSE). 2017, 335–346

[62] Zhang Y, Wang J, Huang H, Zhang Y, Liu P . Understanding and conquering the difficulties in identifying third-party libraries from millions of android apps. IEEE Transactions on Big Data, 2022, 8( 6): 1511–1523

RIGHTS & PERMISSIONS

Higher Education Press