CENTRIS: A precise and scalable approach for identifying modified open-source software reuse

Seunghoon Woo, Sunghan Park, Seulbae Kim, Heejo Lee, Hakjoo Oh

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Open-source software (OSS) is widely reused as it provides convenience and efficiency in software development. Despite evident benefits, unmanaged OSS components can introduce threats, such as vulnerability propagation and license violation. Unfortunately, however, identifying reused OSS components is a challenge as the reused OSS is predominantly modified and nested. In this paper, we propose CENTRIS, a precise and scalable approach for identifying modified OSS reuse. By segmenting an OSS code base and detecting the reuse of a unique part of the OSS only, CENTRIS is capable of precisely identifying modified OSS reuse in the presence of nested OSS components. For scalability, CENTRIS eliminates redundant code comparisons and accelerates the search using hash functions. When we applied CENTRIS on 10,241 widely-employed GitHub projects, comprising 229,326 versions and 80 billion lines of code, we observed that modified OSS reuse is a norm in software development, occurring 20 times more frequently than exact reuse. Nonetheless, CENTRIS identified reused OSS components with 91% precision and 94% recall in less than a minute per application on average, whereas a recent clone detection technique, which does not take into account modified and nested OSS reuse, hardly reached 10% precision and 40% recall.

Original languageEnglish
Title of host publicationProceedings - 2021 IEEE/ACM 43rd International Conference on Software Engineering, ICSE 2021
PublisherIEEE Computer Society
Pages860-872
Number of pages13
ISBN (Electronic)9780738113197
DOIs
Publication statusPublished - 2021 May
Event43rd IEEE/ACM International Conference on Software Engineering, ICSE 2021 - Virtual, Online, Spain
Duration: 2021 May 222021 May 30

Publication series

NameProceedings - International Conference on Software Engineering
ISSN (Print)0270-5257

Conference

Conference43rd IEEE/ACM International Conference on Software Engineering, ICSE 2021
Country/TerritorySpain
CityVirtual, Online
Period21/5/2221/5/30

Keywords

  • Open-Source Software
  • Software Composition Analysis
  • Software Security

ASJC Scopus subject areas

  • Software

Fingerprint

Dive into the research topics of 'CENTRIS: A precise and scalable approach for identifying modified open-source software reuse'. Together they form a unique fingerprint.

Cite this