## 4 Evaluation
### Efficiency  
In this section, we investigate the detection time of BBDetector and compare it with the B2 SFinder and ModX in terms of the nix binary dataset. We compare the detection time of BBDetector with existing tools by employing the nix binary dataset. Note that the detection time does not include the database construction time (Since it is a one-time job, we will not consider it in the TPL detection process). Table 6 shows the comparison result of detection time. The first column represents the size (KB) of target binaries and the last three columns represent the average detection time for each target binary of the corresponding size in terms of BBDetector, B2 SFinder and ModX, respectively. Besides, the last line represents the average detection time for all target binaries. Since B2 SFinder only uses basic syntactic features, it has better performance than BBDetector and ModX. BBDetector considers function semantic features that need to perform function embedding, which will also cause time consumption. When both consider semantic features, the TPLs detection time-consuming of BBDetector is only 30.02% of ModX, which greatly improves the detection efficiency. ModX performs expensive graph matching and function semantic matching. When it measures similarities, which are mainly unstructured data, it must compare these features one by one in the detection procedure. However, we store these features using quantization-based indexes and search them efficiently, which greatly improves time efficiency. Next, we analyze the time complexity of the third-party libraries detection based on function features. Assuming the target binary is represented as \(B=vb_{1},vb_{2},\ldots,vb_{m}\), where \(m\) is the number of functions in \(B\). The third-party libraries are represented as \begin{table}
\begin{tabular}{c c c} \hline \hline
**Size** & **BBDetector** & **B2 SFinder** & **ModX** \\ \hline Set (0 100 KB) & 46.1 & 49.8 & 255 \\ Set (100–1000 KB) & 251.6 & 157.3 & 915.3 \\ Set (\(>\)1000 KB) & 1141.4 & 245.5 & 3538.8 \\ \hline Average & 432.4 & 162.9 & 1440.6 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The average detection time of TPL detection for nix binary dataset(s). \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Binary**} & \multirow{2}{*}{**Libs Linked**} & \multicolumn{3}{c}{**BBDetector**} & \multicolumn{3}{c}{**B2 SFinder**} & \multicolumn{3}{c}{**ModX**} \\ \cline{3-10}  & & **TP** & **FP** & **FN** & **TP** & **FP** & **FN** & **TP** & **FP** & **FN** \\ \hline busybox & 3 & 2 & 0 & 1 & 2 & 0 & 1 & 1 & 1 & 2 \\ openssl & 5 & 4 & 0 & 1 & 3 & 0 & 2 & 2 & 1 & 3 \\ openvpn & 5 & 3 & 1 & 2 & 1 & 2 & 4 & 4 & 0 & 1 \\ sqlite3 & 3 & 1 & 0 & 2 & 1 & 0 & 2 & 3 & 1 & 0 \\ ssldump & 2 & 2 & 1 & 0 & 2 & 1 & 0 & 2 & 0 & 0 \\ tcpdump & 3 & 3 & 1 & 0 & 3 & 1 & 0 & 3 & 0 & 0 \\ vim & 4 & 3 & 1 & 1 & 3 & 1 & 1 & 2 & 0 & 2 \\ Total & 25 & 18 & 4 & 7 & 15 & 5 & 10 & 17 & 3 & 8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: TPL Detection on ubuntu binary dataset. \begin{table}
\begin{tabular}{c c} \hline \hline
**TPL** & **Vulnerabilities Contained in TPL** \\ \hline libc.so.6 & CVE-2022-35023 \\ libpcap.so.0.8 & CVE-2019-15165 \\ libbsd.so.0 & CVE-2019-20367,CVE-2016-2090 \\ libresolv.so.2 & CVE-2015-7547,CVE-2015-5180 \\ libcurl.so.4 & CVE-2016-5421,CVE-2016-5420,CVE-2016-5419,CVE-2015-3153,CVE-2013-1944 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Some vulnerable version of libraries and the vulnerabilities they contain. \(L=L_{1},L_{2},\ldots,L_{k}\), where \(k\) is the number of libraries in the TPL database, and a library \(L_{i}\) in \(L\) is represented as \(L_{i}=vl_{1},vl_{2},\ldots,vl_{n}\), where \(n\) is the average number of functions in \(L_{i}\). If we perform a one-to-one search and matching, the time complexity of the whole detection process based on function features is \(O(m*k*n)\), which is very time-consuming because \(k*n\) is the total number of functions in libraries.