Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
This addresses the timely detection and mitigation of vulnerabilities in open-source software for developers, particularly in industrial settings like SAP, though it is incremental as it builds on existing analysis techniques.
The paper tackles the problem of detecting and mitigating vulnerabilities in open-source software dependencies by introducing a code-centric, usage-based method that improves on metadata-dependent approaches, resulting in over 250,000 scans of 500 applications since 2016.
The use of open-source software (OSS) is ever-increasing, and so is the number of open-source vulnerabilities being discovered and publicly disclosed. The gains obtained from the reuse of community-developed libraries may be offset by the cost of detecting, assessing, and mitigating their vulnerabilities in a timely fashion. In this paper we present a novel method to detect, assess and mitigate OSS vulnerabilities that improves on state-of-the-art approaches, which commonly depend on metadata to identify vulnerable OSS dependencies. Our solution instead is code-centric and combines static and dynamic analysis to determine the reachability of the vulnerable portion of libraries used (directly or transitively) by an application. Taking this usage into account, our approach then supports developers in choosing among the existing non-vulnerable library versions. VULAS, the tool implementing our code-centric and usage-based approach, is officially recommended by SAP to scan its Java software, and has been successfully used to perform more than 250000 scans of about 500 applications since December 2016. We report on our experience and on the lessons we learned when maturing the tool from a research prototype to an industrial-grade solution.