用于Maven的可扩展调用图构造器
Scalable Call Graph Constructor for Maven
摘要：
作为一个丰富的数据源，调用图被用于各种应用，包括安全漏洞检测。尽管多项研究表明调用图可以大大提高分析的准确性，但现有的生态系统规模工具（如Dependabot）并不使用调用图，而是在包级别工作。在生态系统用例中使用调用图是不切实际的，因为调用图生成器存在可扩展性问题。调用图的生成通常被认为是一个“完整的程序分析“，导致大型调用图和昂贵的计算。为了使分析适用于生态系统规模，这种实用的方法不起作用，因为在一个完整的程序中如何组合特定工件的可能组合的数量激增。因此，有必要进行增量分析。已有关于不同类型的增量式程序分析的研究。然而，他们都没有关注整个生态系统的调用图生成。在本文中，我们提出了一个增量实现的CHA算法，可以生成调用图的需求，拼接在一起的部分调用图已提取的库之前。我们的初步评估结果表明，所提出的方法规模以及优于最可扩展的现有框架称为OPAL。
英文摘要：
As a rich source of data, Call Graphs are used for various applications including security vulnerability detection. Despite multiple studies showing that Call Graphs can drastically improve the accuracy of analysis, existing ecosystem-scale tools like Dependabot do not use Call Graphs and work at the package-level. Using Call Graphs in ecosystem use cases is not practical because of the scalability problems that Call Graph generators have. Call Graph generation is usually considered to be a "full program analysis" resulting in large Call Graphs and expensive computation. To make an analysis applicable to ecosystem scale, this pragmatic approach does not work, because the number of possible combinations of how a particular artifact can be combined in a full program explodes. Therefore, it is necessary to make the analysis incremental. There are existing studies on different types of incremental program analysis. However, none of them focuses on Call Graph generation for an entire ecosystem. In this paper, we propose an incremental implementation of the CHA algorithm that can generate Call Graphs on-demand, by stitching together partial Call Graphs that have been extracted for libraries before. Our preliminary evaluation results show that the proposed approach scales well and outperforms the most scalable existing framework called OPAL.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
