# Searching Open-Source Vulnerability Function Based on Software Modularization
## 2 Related Work
### Open-Source Vulnerability Detection  
Open-source components are the core components of software systems. Software systems may occur security vulnerabilities because of relying on open-source components. Software weaknesses are hidden in plain sight and are easily attached by attackers. The number of open-source vulnerabilities discovered and disclosed is growing with increasing open-source components reuse. The research objects are mainly Android applications and commercial software in binary form. Brahmastra [26] is an application automation tool designed to help security researchers test third-party components in mobile applications at run time. Brahmastra is a passive approach that uses dynamic drivers to trigger bug code given a particular vulnerable version of an open-source component. OSSPolice [1] is a fully automated tool that detects third-party component cloning for Android applications. It can quickly analyze application binaries and introduces a novel layered indexing scheme to identify potential software licensing violations and the use of known vulnerable component versions. LibScout [27] is a library detection technique that resizes code obfuscation and can pinpoint the library version used in the application. This approach is the first to quantify the security impact of third-party libraries on the Android ecosystem. B2 SMatcher [3] is a fine-grained version identification of open-source software in binary file method. It uses program-level characteristics for rough matching to identify reuse types, namely single-version reuse and multiversion reuse, then uses function-level features for exact matching. It extracts source code characteristics from compile-related source files by machine learning methods such as K-means clustering and decision tree. B2 SMatcher finds some popular applications, such as Zoom and TeamViewer, reuse vulnerable open-source component versions. FOSSIL [28] is a resilient and efficient system that combines Bayesian networks with greater resilience to code obfuscation and can find open-source packages in malware binaries that match those listed in security and reverse-engineering reports. FIBER [13] proposes a fine-grained patch presence test method, which promotes the similarity-based bug search to a new level. However, FIBER doesn't take into account open-source component variants, which may require compiling and searching a large number of binaries. The specific open-source vulnerability detection are shown in Table 2.  
In general, developers use outdated open-source components and are less aware of potential risks. Therefore, the study of open-source vulnerability can provide practical insights for the sustainable improvement of software systems. Therefore, we propose a directed overlapping modularization method for binary code. Up until now, software module clustering is mainly for source code, and binary modularization is less. BCD [29] divides binary modules by FN [30], a fast community \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Approach** & **Venue** & **Method** & **Application** \\ \hline Brahmastra & USENIX & dynamic drivers & android \\ \hline OSSPolice & CCS & layered indexing scheme & android \\ \hline LibScout & CCS & resizing code obfuscation & android \\ \hline B2 SMatcher & Cybersecurity & rough matching and exact matching & binary files \\ \hline FOSSIL & ACM Transactions on Privacy and Security & Bayesian networks with greater resilience to code obfuscation & binary files \\ \hline FIBER & USENIX & fine-grained patch presence test & binary files \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Open-source vulnerability detection. detection method based on the greedy algorithm, and achieves optimal detection results by measuring modularity. ModX [17] clusters binary functions by the Louvain algorithm based on modularity. There are assumptions in this work; that is, there are not overlapping binary modules.