# Searching Open-Source Vulnerability Function Based on Software Modularization
## 1 Introduction  
Open-source code reuse can speed up program development and programs are applying increasingly open-source components. Studies [1; 2; 3; 4] indicated that commercial software also reuses a large number of open-source components, such as libraries in the firmware of the Internet of things and the Linux kernel. However, the reuse of vulnerable open-source components will cause security issues. For example, Heartbleed [5] (CVE-2014-0160) was discovered in version 1.0.1 of OpenSSL [6], which affected millions of software (e.g., LibreOffice [7], VMware [8]) and devices (e.g., routers, switches, firewalls). VULDEFF [9] proposes a vulnerability-detection method based on function fingerprints and code differences. VGRAPH [10] designs an accurate approximate matching algorithm which is capable of detecting modified vulnerable code clones, and differentiating them from their patched counterparts. Similarly, VELVET [11] and Bgnn4 vd [12] find vulnerable code reuse in source code. To detect the reuse of open-source components, researchers proposed a series of methods based on binary-to-source matching. OSSPolice [1] identifies open-source components through strings and exported function names and detects whether the components have certain types of vulnerabilities, to determine whether components reused in the program are vulnerable versions. B2 SFinder [2] matches string, integer type, and control flow characteristics with different weight algorithms to detect the reuse of open-source components in commercial software, and analyze potential vulnerabilities of components reused. B2 SMatcher [3] uses program-level features for rough matching to determine single-version and multiversion reuse, then uses function-level features for exact matching. Someapplications have been found to reuse vulnerable versions of open-source components. Nevertheless, the above methods are limited to only providing module-level information (e.g., reused vulnerable versions of open-source components), without giving the specific location of the vulnerable function in binary. Usually, it is hard to detect vulnerability in binary executables. Consequently, few methods detect reused binary vulnerability functions. With the source code of the vulnerable open-source components, researchers [13; 14] can extract source-level information in open-source components to assist vulnerability detection in binary executables. According to the features of vulnerable functions in open-source components, they search for the reused vulnerable binary functions. However, all binary functions need to be compared with source vulnerability functions to determine the binary vulnerability functions, which is time consuming. To solve the above problems, we propose an open-source vulnerability detection method based on software modularization, named the binary modularization-based vulnerability (BMVul) function. First, we extract the directed call graph of binary functions. Then, we cluster functions by overlapping community detection technology based on statistical significance OSLOM [15] that integrates modularity and information theory algorithms. Based on modularity, we carry out feature-based software component analysis. According to the modular software component analysis results, we detect vulnerability types and specific vulnerability functions in open-source components through function signature, then search the corresponding binary vulnerability functions in the modules reusing components. In order to evaluate the effectiveness of BMVul, we collect the dataset from ISRD [16] and ModX [17]. The experimental results show that BMVul significantly outperforms existing methods. The precision of BMVul increases by 3.16% and 59.57% than component detection based on Louvain [18] and B2 SFinder, respectively. Moreover, the precision of matching a unique binary module is improved by 39.43% compared to Louvain detection. The F1 score increases by 8.45% over B2 SFinder.