Page 145 - 《软件学报》2026年第7期

2830 软件学报 2026 年第 37 卷第 7 期

[45] Sonatype. OSS index analyzer. 2025. https://jeremylong.github.io/DependencyCheck/data/ossindex.html
[46] Xiao Y, Chen BH, Yu CD, Xu ZZ, Yuan ZM, Li F, Liu BH, Liu Y, Huo W, Zou W, Shi WC. MVP: Detecting vulnerabilities using patch-
enhanced vulnerability signatures. In: Proc. of the 29th USENIX Security Symp. (USENIX Security 20). USENIX, 2020. 1165–1182.
[47] Li Z, Lu S, Myagmar S, Zhou Y. CP-Miner: Finding copy-paste and related bugs in large-scale software code. IEEE Trans. on Software
Engineering, 2006, 32(3): 176–192. [doi: 10.1109/TSE.2006.28]
[48] Jiang LX, Su ZD, Chiu E. Context-based detection of clone-related bugs. In: Proc. of the 6th Joint Meeting of the European Software
Engineering Conf. and the ACM SIGSOFT Symp. on the Foundations of Software Engineering. Dubrovnik: ACM, 2007. 55–64. [doi: 10.
1145/1287624.1287634]
[49] Gabel M, Yang JF, Yu Y, Goldszmidt M, Su ZD. Scalable and systematic detection of buggy inconsistencies in source code. In: Proc. of
the 2010 ACM Int’l Conf. on Object-oriented Programming Systems Languages and Applications. Reno: ACM, 2010. 175–190. [doi: 10.
1145/1869459.1869475]
[50] Pham NH, Nguyen TT, Nguyen HA, Nguyen TN. Detection of recurring software vulnerabilities. In: Proc. of the 25th IEEE/ACM Int’l
Conf. on Automated Software Engineering. Antwerp: ACM, 2010. 447–456. [doi: 10.1145/1858996.1859089]
[51] Li YK, Xue YX, Chen HX, Wu XH, Zhang C, Xie XF, Wang HJ, Liu Y. Cerebro: Context-aware adaptive fuzzing for effective
vulnerability detection. In: Proc. of the 27th ACM Joint Meeting on European Software Engineering Conf. and Symp. on the Foundations
of Software Engineering. Tallinn: ACM, 2019. 533–544. [doi: 10.1145/3338906.3338975]
[52] Xu ZZ, Chen BH, Chandramohan M, Liu Y, Song F. SPAIN: Security patch analysis for binaries towards understanding the pain and
pills. In: Proc. of the 39th IEEE/ACM Int’l Conf. on Software Engineering (ICSE). Buenos Aires: IEEE, 2017. 462–472. [doi: 10.1109/
ICSE.2017.49]
[53] Jang J, Agrawal A, Brumley D. ReDeBug: Finding unpatched code clones in entire OS distributions. In: Proc. of the 2012 IEEE Symp. on
Security and Privacy. San Francisco: IEEE, 2012. 48–62. [doi: 10.1109/SP.2012.13]
[54] Na Y, Woo S, Lee J, Lee H. CNEPS: A precise approach for examining dependencies among third-party C/C++ open-source components.
In: Proc. of the 46th IEEE/ACM Int’l Conf. on Software Engineering. Lisbon: ACM, 2024. 236. [doi: 10.1145/3597503.3639209]
[55] Ain QU, Butt WH, Anwar MW, Azam F, Maqbool B. A systematic review on code clone detection. IEEE Access, 2019, 7: 86121–86144.
[doi: 10.1109/ACCESS.2019.2918202]
[56] Johnson JH. Substring matching for clone detection and change tracking. In: Proc. of the 1994 Int’l Conf. on Software Maintenance.
Victoria: IEEE, 1994. 120–126. [doi: 10.1109/ICSM.1994.336783]
[57] Ducasse S, Rieger M, Demeyer S. A language independent approach for detecting duplicated code. In: Proc. of the 1999 IEEE Int’l Conf.
on Software Maintenance (ICSM 1999). Oxford: IEEE, 1999. 109–118. [doi: 10.1109/ICSM.1999.792593]
[58] Roy CK, Cordy JR. NICAD: Accurate detection of near-miss intentional clones using flexible pretty-printing and code normalization. In:
Proc. of the 16th IEEE Int’l Conf. on Program Comprehension. Amsterdam: IEEE, 2008. 172–181. [doi: 10.1109/ICPC.2008.41]
[59] Liu C, Chen C, Han JW, Yu PS. GPLAG: Detection of software plagiarism by program dependence graph analysis. In: Proc. of the 12th
ACM SIGKDD Int’l Conf. on Knowledge Discovery and Data Mining. Philadelphia: ACM, 2006. 872–881. [doi: 10.1145/1150402.
1150522]
[60] Jiang LX, Misherghi G, Su ZD, Glondu S. DECKARD: Scalable and accurate tree-based detection of code clones. In: Proc. of the 29th
Int’l Conf. on Software Engineering (ICSE 2007). Minneapolis: IEEE, 2007. 96–105. [doi: 10.1109/ICSE.2007.30]

作者简介
徐美秋, 博士生, CCF 学生会员, 主要研究领域为开源软件供应链安全, 软件成分分析技术.
王舒婧, 硕士生, 主要研究领域为开源软件供应链安全, 软件成分分析技术.
王莹, 博士, 副教授, 博士生导师, CCF 专业会员, 主要研究领域为智能软件开发技术, 开源软件供应链安全, 开源治理技术, 国产平台软件
迁移适配技术.
于海, 博士, 副教授, 主要研究领域为软件测试, 软件重构及软件测试技术, 软件体系结构, 复杂网络理论, 混沌加密技术.
朱志良, 博士, 教授, 博士生导师, CCF 专业会员, 主要研究领域为混沌加密技术, 复杂网络理论, 软件测试技术.