Vuln4Real: A Methodology for Counting Actually Vulnerable Dependencies
| Autor: | Henrik Plate, Ivan Pashchenko, Fabio Massacci, Antonino Sabetta, Serena Elisa Ponta |
|---|---|
| Rok vydání: | 2022 |
| Předmět: |
Java
Computer science Libraries 02 engineering and technology Audit Ecosystems Software dependencies Tools Software 020204 information systems 0202 electrical engineering electronic engineering information engineering Code (cryptography) Lagging computer.programming_language Free Open Source Software business.industry Industrial impact 020207 software engineering Mining Software Repositories Open source software Data science Security Vulnerable Dependency business computer Dependency (project management) |
| Zdroj: | IEEE Transactions on Software Engineering |
| ISSN: | 2326-3881 0098-5589 |
| Popis: | Vulnerable dependencies are a known problem in today's free open-source software ecosystems because FOSS libraries are highly interconnected, and developers do not always update their dependencies. Our paper proposes Vuln4Real, the methodology for counting actually vulnerable dependencies, that addresses the over-inflation problem of academic and industrial approaches for reporting vulnerable dependencies in FOSS software, and therefore, caters to the needs of industrial practice for correct allocation of development and audit resources. To understand the industrial impact of a more precise methodology, we considered the 500 most popular FOSS Java libraries used by SAP in its own software. Our analysis included 25767 distinct library instances in Maven. We found that the proposed methodology has visible impacts on both ecosystem view and the individual library developer view of the situation of software dependencies: Vuln4Real significantly reduces the number of false alerts for deployed code (dependencies wrongly flagged as vulnerable), provides meaningful insights on the exposure to third-parties (and hence vulnerabilities) of a library, and automatically predicts when dependency maintenance starts lagging, so it may not receive updates for arising issues. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|