本研究利用 World of Code 基础设施测量了开源软件中基于拷贝的复用普遍程度及影响因素，发现该复用方式普遍存在且受项目规模、文件类型和时间影响，为未来提升复用效率与降低风险的研究奠定基础。
摘要：
在开源软件中，任何项目的资源都可以通过引入依赖或直接拷贝资源本身来进行复用。与基于依赖的复用相比，系统性地支持基于拷贝的复用的基础设施似乎完全缺失。我们的目标是推动未来的研究和工具开发，以提高基于拷贝的复用的效率并降低其风险。我们通过测量其普遍程度并识别影响复用倾向的因素，来更好地理解这种复用行为。为了识别被复用的制品并追踪其来源，我们的方法利用了 World of Code 基础设施。我们从一组与复用倾向相关的理论推导因素出发，抽样了不同复用类型的实例，并对开发者进行调查以更好地理解他们的意图。结果表明，基于拷贝的复用很普遍，许多开发者在编写代码时意识到这一点。文件被复用的倾向在不同编程语言之间以及源代码和二进制文件之间存在很大差异，并且随着时间的推移持续下降。由热门项目引入的文件更有可能被复用，但至少一半的被复用资源源自“小型”和“中型”项目。开发者进行复用的原因各不相同，但普遍对使用包管理器持积极态度。
英文摘要：
In Open Source Software, resources of any project are open for reuse by introducing dependencies or copying the resource itself. In contrast to dependency-based reuse, the infrastructure to systematically support copy-based reuse appears to be entirely missing. Our aim is to enable future research and tool development to increase efficiency and reduce the risks of copy-based reuse. We seek a better understanding of such reuse by measuring its prevalence and identifying factors affecting the propensity to reuse. To identify reused artifacts and trace their origins, our method exploits World of Code infrastructure. We begin with a set of theory-derived factors related to the propensity to reuse, sample instances of different reuse types, and survey developers to better understand their intentions. Our results indicate that copy-based reuse is common, with many developers being aware of it when writing code. The propensity for a file to be reused varies greatly among languages and between source code and binary files, consistently decreasing over time. Files introduced by popular projects are more likely to be reused, but at least half of reused resources originate from ``small'' and ``medium'' projects. Developers had various reasons for reuse but were generally positive about using a package manager.
Third-party libraries (TPLs) are frequently reused in software to reduce development cost and the time to market. However, external library dependencies may introduce vulnerabilities into host applications. The issue of library dependency has received considerable critical attention. Many package managers, such as Maven, Pip, and NPM, are proposed to manage TPLs. Moreover, a significant amount of effort has been put into studying dependencies in language ecosystems like Java, Python, and JavaScript except C/C++. Due to the lack of a unified package manager for C/C++, existing research has only…
Software reuse may result in software bloat when significant portions of application dependencies are effectively unused. Several tools exist to remove unused (byte)code from an application or its dependencies, thus producing smaller artifacts and, potentially, reducing the overall attack surface. In this paper we evaluate the ability of three debloating tools to distinguish which dependency classes are necessary for an application to function correctly from those that could be safely removed. To do so, we conduct a case study on a real-world commercial Java application. Our study shows that t…
Nowadays, exploits often rely on a code-reuse approach. Short pieces of code called gadgets are chained together to execute some payload. Code-reuse attacks can exploit vulnerabilities in the presence of operating system protection that prohibits data memory execution. The ROP chain construction task is the code generation for the virtual machine defined by an exploited executable. It is crucial to understand how powerful ROP attacks can be. Such knowledge can be used to improve software security. We implement MAJORCA that generates ROP and JOP payloads in an architecture agnostic manner and t…
Repository for Reusing Artifacts of Artificial Neural Networks
HTW University of Applied Sciences（HTW应用科学大学）；University of Guilan（吉兰大学）；Pitzer College（皮策学院）；University Hospital Bonn（波恩大学医院）；University of Southampton（南安普顿大学）
Cyber-Physical Production Systems (CPPS) are long-living and mechatronic systems, which include mechanics, electrics/electronics and software. The interdisciplinary nature combined with challenges and trends in the context of Industry 4.0 such as a high degree of customization, small lot sizes and evolution cause a high amount of variability. Mastering the variability of functional control software, e.g., different control variants of an actuator type, is itself a challenge in developing and reusing CPPS software. This task becomes even more complex when considering extra-functional software s…
