# Searching Open-Source Vulnerability Function Based on Software Modularization
## 3 Methodology
### Software Component Analysis Based on Program Modularization  
#### 3.1.1 Program Modularization Method Based on Directed Graph  
Software modularization aims at functions clustering. It performs a cluster analysis on the set of functions so that functions defined in proximity to one another and functions that frequently call one another will belong to the same cluster. Modularization refers to the process of dividing the program into relatively self-contained components or modules. Typically, each module encapsulates a fundamental set of related functionalities. However, the modularization will be broken during the compilation process because the compiler will merge all functions into one binary file. Faced with such a good deal of functions, it is not convenient for binary code analysis. Therefore, we propose a binary code modularization method to narrow the search task scope in software security analysis. The current binary modularization work divides modules for undirected graphs without considering overlapping communities. Therefore, given these limitations, we  
Figure 1: Workflow of BMVul. propose an OSLOM-based DBM for directed graphs and overlapping modules. Unlike most binary analysis work, which only requires local analysis, binary program modularization is a global understanding of the program. Therefore, we extract the function call graph (FCG), which is defined as Equation (1),  
\[G=(V,E,W) \tag{1}\]  
\[E=\{(a,b)|a,b\in V\} \tag{2}\]  
\[W=\{W_{ab}|a,b\in V\}, \tag{3}\]  
where \(V\) is the set of all functions, \(E\) represents the set of calling edges between all functions, which is defined as Equation (2), pointing from the caller to the callee, and \(W\) represents the set of edge weights, which is defined as Equation (3). The more call times between functions, the greater the probability that they complete the same functionality, that is, they belong to the same module. The directed edge call weight from \(a\) to \(b\) expresses call times from function \(a\) to function \(b\), which is defined as Equation (4),  
\[W_{ab}= \begin{cases}n_{ab},&\text{if}\,(a,b)\in E_{ab}\\ 0,&\text{otherwise},\end{cases}  \tag{4}\]  
where \(W_{ab}\) is the edge weight from function \(a\) to function \(b\), \(n_{ab}\) is function calls times from \(a\) to \(b\), and \(E_{ab}\) is the set of calling edges from \(a\) to \(b\). We take the directed function call graph as the input information of module partition and use the DBM method based on the OSLOM idea to divide binary modules. OSLOM algorithm takes significance [31] as a measure to evaluate the clusters (module), which is defined as the probability of finding the cluster in a random null model; that is, in a class of graphs without community structure, the same as the empty model used in modularity optimization [32], indicating the possibility of the community emerging in a randomized network. The realization of the OSLOM-based DBM method is divided into three steps, as shown in Figure 2.  
Step 1: We use a significance score to detect important modules until they converge. The initial node is a single function. We calculate the probability of adding adjacent nodes to the node, then delete unimportant nodes. We set the convergence threshold to 0.1, which can achieve the best performance. Step 2: Based on the set of modules in Step 1, we detect the internal structure of modules or possible mergers between modules to find the minimum clustering result. Step 3: Detecting the hierarchical structure of modules. The above steps form fundamental function clustering results, in which each module becomes a new node. If there are edges between two nodes, a new edge is formed between them, and the edge weight is the sum of the edge weights between them. A new supernetwork emerges again, by that analogy, until the process no longer produces new modules.