{"id":"https://openalex.org/W4402259192","doi":"https://doi.org/10.1109/tse.2024.3454960","title":"Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries","display_name":"Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries","publication_year":2024,"publication_date":"2024-09-05","ids":{"openalex":"https://openalex.org/W4402259192","doi":"https://doi.org/10.1109/tse.2024.3454960"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2024.3454960","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2024.3454960","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2409.02753","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Fangyuan Zhang","orcid":"https://orcid.org/0009-0000-9599-1369"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fangyuan Zhang","raw_affiliation_strings":["DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0009-0000-9599-1369","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lingling Fan","orcid":"https://orcid.org/0000-0002-2428-9297"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lingling Fan","raw_affiliation_strings":["DISSec, NDST, College of Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0000-0002-2428-9297","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100658276","display_name":"Sen Chen","orcid":"https://orcid.org/0000-0001-9477-4100"},"institutions":[{"id":"https://openalex.org/I162868743","display_name":"Tianjin University","ror":"https://ror.org/012tb2g32","country_code":"CN","type":"education","lineage":["https://openalex.org/I162868743"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sen Chen","raw_affiliation_strings":["College of Intelligence and Computing, Tianjin University, Tianjin, China","College of Intelligence and Computing, Tianjin University, China"],"raw_orcid":"https://orcid.org/0000-0001-9477-4100","affiliations":[{"raw_affiliation_string":"College of Intelligence and Computing, Tianjin University, Tianjin, China","institution_ids":["https://openalex.org/I162868743"]},{"raw_affiliation_string":"College of Intelligence and Computing, Tianjin University, China","institution_ids":["https://openalex.org/I162868743"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114221413","display_name":"Miaoying Cai","orcid":null},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Miaoying Cai","raw_affiliation_strings":["DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0009-0002-2747-3169","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077412882","display_name":"Sihan Xu","orcid":"https://orcid.org/0000-0002-6887-6231"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sihan Xu","raw_affiliation_strings":["DISSec, NDST, College of Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0000-0002-6887-6231","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082037581","display_name":"Lida Zhao","orcid":"https://orcid.org/0009-0005-9832-8948"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Lida Zhao","raw_affiliation_strings":["School of Computer Science and Engineering, Nanyang Technological University, Singapore","Computer Science and EngineeringNanyang Technological University"],"raw_orcid":"https://orcid.org/0009-0005-9832-8948","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Computer Science and EngineeringNanyang Technological University","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.3714,"has_fulltext":true,"cited_by_count":10,"citation_normalized_percentile":{"value":0.96498576,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"50","issue":"11","first_page":"2906","last_page":"2920"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9958999752998352,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8075157403945923},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6661827564239502},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.47083258628845215},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.45325782895088196},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.42023709416389465},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.36159610748291016},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3268929123878479}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8075157403945923},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6661827564239502},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47083258628845215},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.45325782895088196},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.42023709416389465},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.36159610748291016},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3268929123878479},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tse.2024.3454960","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2024.3454960","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2409.02753","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.02753","pdf_url":"https://arxiv.org/pdf/2409.02753","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2409.02753","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.02753","pdf_url":"https://arxiv.org/pdf/2409.02753","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.4399999976158142,"id":"https://metadata.un.org/sdg/10"}],"awards":[{"id":"https://openalex.org/G2411639239","display_name":null,"funder_award_id":"62102197","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G332475328","display_name":null,"funder_award_id":"22JCYBJC01010","funder_id":"https://openalex.org/F4320323993","funder_display_name":"Natural Science Foundation of Tianjin City"},{"id":"https://openalex.org/G5755501204","display_name":null,"funder_award_id":"62202245","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320323993","display_name":"Natural Science Foundation of Tianjin City","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4402259192.pdf","grobid_xml":"https://content.openalex.org/works/W4402259192.grobid-xml"},"referenced_works_count":37,"referenced_works":["https://openalex.org/W2065489029","https://openalex.org/W2274324447","https://openalex.org/W2286924183","https://openalex.org/W2532717356","https://openalex.org/W2618014206","https://openalex.org/W2766078311","https://openalex.org/W2791591648","https://openalex.org/W2796466931","https://openalex.org/W2883170413","https://openalex.org/W2889097348","https://openalex.org/W2899324080","https://openalex.org/W2925087824","https://openalex.org/W2953934237","https://openalex.org/W2957010138","https://openalex.org/W2963321189","https://openalex.org/W2964080672","https://openalex.org/W3040158574","https://openalex.org/W3088691441","https://openalex.org/W3091065534","https://openalex.org/W3094949573","https://openalex.org/W3127006109","https://openalex.org/W3161799213","https://openalex.org/W3200506265","https://openalex.org/W4221145571","https://openalex.org/W4233106339","https://openalex.org/W4312247631","https://openalex.org/W4313045094","https://openalex.org/W4313549796","https://openalex.org/W4313563521","https://openalex.org/W4384155580","https://openalex.org/W4384345626","https://openalex.org/W4384345720","https://openalex.org/W4384345738","https://openalex.org/W4388502396","https://openalex.org/W4389164790","https://openalex.org/W4402443177","https://openalex.org/W6628532452"],"related_works":["https://openalex.org/W1883246888","https://openalex.org/W2370114625","https://openalex.org/W1756374135","https://openalex.org/W2947584067","https://openalex.org/W3118510577","https://openalex.org/W2280562859","https://openalex.org/W230721595","https://openalex.org/W3157230915","https://openalex.org/W1496728123","https://openalex.org/W2062873522"],"abstract_inverted_index":{"Developers":[0],"usually":[1],"use":[2],"third-party":[3],"libraries":[4],"(TPLs)":[5],"to":[6,13,154,203,225,255],"facilitate":[7],"the":[8,16,19,42,46,52,110,115,133,226,235,257],"development":[9],"of":[10,29,45,100,169,187,209,251,260,284,295],"their":[11],"projects":[12,35,274,285],"avoid":[14],"reinventing":[15],"wheels,":[17],"however,":[18],"vulnerable":[20,37,43,87,98,134,157,161,175,207,252,278,301],"TPLs":[21,38,47,93,101,192,210],"indeed":[22,49],"cause":[23],"severe":[24],"security":[25],"threats.":[26],"The":[27,196],"majority":[28],"existing":[30],"research":[31],"only":[32,282],"considered":[33],"whether":[34,41],"used":[36,50,102,211],"but":[39],"neglected":[40],"code":[44],"was":[48],"by":[51,103,123,140,212],"projects,":[53,265],"which":[54,83],"inevitably":[55],"results":[56],"in":[57,92,241],"false":[58,178,218,222,288,307],"positives":[59,219,308],"and":[60,66,94,118,164,220,229,280,291],"further":[61,95,131],"requires":[62],"additional":[63],"patching":[64],"efforts":[65],"maintenance":[67],"costs":[68],"(e.g.,":[69],"dependency":[70],"conflict":[71],"issues":[72],"after":[73],"version":[74,163],"upgrades).":[75],"To":[76],"mitigate":[77],"such":[78],"a":[79,125,166,182,200,269,292],"problem,":[80],"we":[81,107,130,148,266],"proposeVAScanner,":[82],"can":[84],"effectively":[85],"identify":[86,96,132,155],"root":[88,135],"methods":[89,113,122,136],"causing":[90],"vulnerabilities":[91,261],"all":[97,156],"APIs":[99,158,208],"Java":[104],"projects.":[105,213],"Specifically,":[106],"first":[108],"collect":[109],"initial":[111],"patch":[112,116,121],"from":[114,190],"commits":[117],"extract":[119],"accurate":[120],"employing":[124,141],"patch-unrelated":[126],"sifting":[127,228],"mechanism,":[128],"then":[129],"for":[137,159],"each":[138,160],"vulnerability":[139,238],"an":[142],"augmentation":[143,230],"mechanism.":[144],"Based":[145],"on":[146,262,272,277],"them,":[147],"leverage":[149],"backward":[150],"call":[151],"graph":[152],"analysis":[153,271],"TPL":[162],"construct":[165],"database":[167,197,202],"consisting":[168],"90,749":[170],"(2,410,779":[171],"with":[172,181,193],"library":[173],"versions)":[174],"APIswith":[176],"1.45%":[177],"positive":[179,289],"proportion":[180,290],"95%":[183,293],"confidence":[184],"interval":[185],"(CI)":[186],"[1.31%,":[188],"1.59%]":[189],"362":[191],"14,775":[194],"versions.":[195],"serves":[198],"as":[199],"reference":[201],"help":[204],"developers":[205],"detect":[206],"Our":[214],"experiments":[215],"showVAScannereliminates":[216],"5.78%":[217],"2.16%":[221],"negatives":[223],"owing":[224],"proposed":[227],"mechanisms.":[231],"Besides,":[232],"it":[233],"outperforms":[234],"state-of-the-art":[236],"method-level":[237],"detection":[239,250],"tool":[240],"analyzing":[242],"direct":[243],"dependencies,":[244],"Eclipse":[245],"Steady,":[246],"achieving":[247],"more":[248],"effective":[249],"APIs.":[253],"Furthermore,":[254],"investigate":[256],"real":[258,263],"impact":[259],"open-source":[264],"exploitVAScannerto":[267],"conduct":[268],"large-scale":[270],"3,147":[273],"that":[275],"depend":[276],"TPLs,":[279],"find":[281],"21.51%":[283],"(with":[286],"1.83%":[287],"CI":[294],"[0.71%,":[296],"4.61%])":[297],"were":[298],"threatened":[299],"through":[300],"APIs,":[302],"demonstrating":[303],"thatVAScannercan":[304],"potentially":[305],"reduce":[306],"significantly.":[309]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":6}],"updated_date":"2026-08-14T07:06:38.338062","created_date":"2024-09-06T00:00:00"}