# Searching Open-Source Vulnerability Function Based on Software Modularization
## 5 Conclusions  
In this paper, we propose BMVul, a binary modularization-based open-source vulnerability function detection method. BMVul performs binary module-level open-source component identification and then detects vulnerability functions in the located binary module. The experiment results show that BMVul outperforms the state-of-the-art methods B2 SFinder and Louvain detection in effectiveness and performs well in binary vulnerability function detection. The precision of BMVul outperforms B2 SFinder by 59.57%. Moreover, compared with Louvain detection, the precision of matching a unique binary module increases by 39.43%. At present, most detection methods are limited to the file granularity, which is time-consuming for vulnerability function searching. However, we can find reused components at module granularity. With the achieved accuracy, we can find correct binary module reused components. In vulnerability function analysis stage, instead of doing a lot of global analysis, we only need to analyze specific binary modules. Additionally, binary modularization-based detection greatly reduces the search scope of open-source vulnerability functions in binary programs, which is of great significance to software se  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Binary** &
\begin{tabular}{l} **Vulnerable** \\ **Component** \\ \end{tabular} & **CVE** & **Vulnerable Function** & **Reuse** \\ \hline openvpn & openssl & CVE-2014-3571 & ssl3\_read\_n & ✓ \\  & & CVE-2013-0166 & ASN1\_item\_verify & ✓ \\  & & CVE-2014-8275 & ASN1\_verify & × \\  & & CVE-2013-4353 & ssl3\_take\_mac & × \\  & & tls\_construct\_finished & × \\  & & CVE-2015-0288 & X509\_to\_X509\_REQ & ✓ \\  & & CVE-2017-3730 & ssl\_ctx\_make\_profiles & ✓ \\  & & CVE-2014-3513 & tls\_construct\_ck\_dhc & × \\  & & CVE-2017-3731 & chachacha20\_poly1305\_ctrl & × \\  & & CVE-2017-3733 & tls\_change\_cipher\_state & ✓ \\ \hline lzbench & zstd & CVE-2019-11922 & ZSTD\_encodeSequences & ✓ \\  & & ZSTD\_compressSequences\_internal & × \\ turbobench & & ZSTD\_encodeSequences\_body & × \\  & & ZSTD\_encodeSequences\_default & × \\ Libblosc & & writeSequences & × \\ \hline redis-server & lua & CVE-2018-11218 & mp\_encode\_lu\_tablecurity analysis. However, there may be other properties that can be created to make the modularization results better. Moreover, we can try to find other features that are more suitable for binary-source comparison to get more accurate results. Although the current technology has not reached the ideal result, it will certainly be improved in the future with more in-depth research.  
Conceptualization, X.G.; data curation, R.C. and W.S.; methodology, X.G.; software, X.G. and S.L.; formal analysis, X.Y.; writing--original draft preparation, X.G.; writing--review and editing, X.G. and X.Y. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the Foundation Strengthening Key Project of the Science & Technology Commission (2019-JCJQ-ZD-113).  
Not applicable.  
The calculated data presented in this work are available from the corresponding authors upon reasonable request.  
The author would like to thank the anonymous reviewers for their valuable comments on our paper.  
The authors declare no conflict of interest.