## 3 Methodology
### TPL Detetction
#### 3.4.1 TPL Detection Based on String Features  
In TPL detection based on string features, we calculate the matching score between the target binary and TPLs. The matching score is calculated based on the matched weighted feature instances. As the number of matched feature instances increases, the matching score increases. Therefore, we set a threshold for the matching score, the same as B2 SFinder. Specifically, when the matching score satisfies any of the following conditions: (1) the ratio of the matched strings between the target binary and a library is greater than 0.5, as shown in Equation (2); (2) the sum weight of matched string instances is larger than 100, and the ratio of this weight is larger than 0.1, as shown in Equation (3). We consider the target binary having a reuse relationship with the corresponding library.  
\[\frac{|S_{B}\cap S_{L}|}{|S_{L}|}>0.5 \tag{2}\]  
\[W(S_{B}\cap S_{L})>100\ \&\ \frac{W(S_{B}\cap S_{L})}{W(S_{L})}>0.1 \tag{3}\]  
where \(S_{B}\) represents the string instances including in the target binary \(B\); \(S_{L}\) represents the string instances including in the library \(L\) to be compared; \(|S_{B}\cap S_{L}|\) represents the number of common string instances including both \(B\) and \(L\); \(W(S_{B}\cap S_{L})\) represents the weight sum of the common string instances; and \(W(S_{L})\) represents the weight sum of string instances including in \(L\).  
The specific algorithm of TPL detection based on string features is shown in Algorithm 1. The algorithm's input is the string features \(S_{B}\) of the target binary and the string index tables. Firstly, we obtain the candidate reused TPLs based on the strings included in the target binary and the string inverted index table (line 2-4). When a string of the target binary is in the index table, we take libraries that include this string as candidate reused TPL. Then, for each candidate library, we calculate the matching score and compare it with the predefined threshold to determine whether it is reused by the target binary (line 5-20). We obtain the matched string instances between the target binary and the candidate library (line 8-11). Then, we calculate the weight sum of matched string instances (line 12-16). Last, we calculate the matching scores to determine whether the values are greater than the threshold and whether this library is reused by the target binary (line 17-19).  
```
1:functionTPL_detection_based_on_string_features(\(S_{B}\))
2:candidate_matched_libs \(\leftarrow\)[]
3:fors in \(S_{B}\)do
4:candidate_matched_libs.append(GET_libs(s)) //feature match
5:matched_libs \(\leftarrow\)[]
6:forlib in candidate_matched_libs do
7:\(S_{L}\leftarrow\)GET_stringGS(\(lib\)) // match string instances
8:\(S_{m}\leftarrow\)[]
9:for\(s_{b}\times s_{l}\in S_{B}\times S_{L}\)do
10:if\(s_{b}=s_{l}\)then
11:\(S_{m}.append(s_{l})\) //calculate weights
12:fors in \(S_{L}\)do
13:W \(\leftarrow\)GET_LIB_STRING_weight(s)
14:\(W_{L}\leftarrow\)W\({}_{L}\)+W
15:ifs in \(S_{m}\)then
16:\(W_{m}\gets W_{m}\)+W //calculate matching scores
17:score \(\leftarrow\)\(W_{m}\)/\(W_{L}\)
18:ifscore \(\geq\) threshold then
19:matched_libs.append(lib)
20:returnmatched_libs
```  
**Algorithm 1**TPL detection based on string features