Abstract

摘要： 随着软件开发日益复杂化及开源组件的广泛使用，准确识别软件中的开源组件及其潜在安全漏洞已成为保障软件供应链安全的关键任务。文章系统性地梳理了开源组件识别与第三方开源组件漏洞检测两方面的核心技术与方法，并对未来研究方向提出展望，旨在为构建更为安全、可信的软件供应链提供理论支撑与技术参考。

关键词: 软件供应链安全, 开源组件识别, 开源组件检测, 风险识别

CLC Number:

TP309

焦涵, 王勇, 吴沁玥. 开源软件供应链中第三方组件检测研究[J]. 信息安全研究, 2026, 12(E1): 104-107.

[1] ZHANG F, FAN L, CHEN S, et al. Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries[J]. IEEE Transactions on Software Engineering, 2024, 50(11): 2906-2920 . [2] XU S, DONG J, CAI W, et al. Enhancing Security in Third-Party Library Reuse – Comprehensive Detection of 1-day Vulnerability through Code Patch Analysis [EB/OL]. 2024[2025-12-23]. https://arxiv.org/pdf/2411. 19648. [3] CHENG Y, ZHANG T, SHAR L K, et al.Vercation: Precise Vulnerable Open-Source Software Version Identification Based on Static Analysis and LLM[J]. IEEE Transactions on Software Engineering, 2026, 52(2): 376-394. [4] Sun L .Securing Supply Chains in Open Source Ecosystems: Methodologies for Determining Version Numbers of Components Without Package Management Files[J]. Journal of Computing and Electronic Information Management, 2024, 12(1):32-36. [5] SHEN W, SHEN G, WANG Y, et al.AI-Driven Open Source Component Security Analysis and Intelligent Vulnerability Prediction Model [EB/OL]. 2025[2026-04-30]. http://ieeexplore.ieee.org/document/11136289/. [6] 胡飞，陈昊，王媛，等. 基于图网络的Java反序列化漏洞检测方法[J]. 计算机技术与发展，2023，33（5）：122-129. [7] NOCERA S, VEGAS S, SCANNIELLO G, et al.Software Composition Analysis and Supply Chain Security in Apache Projects: an Empirical Study [EB/OL]. 2025[2026-04-30]. https://ieeexplore.ieee.org/document/11025577. [8] 陈克豪，程伟，丁荪，等. 开源组件安全面对安全左移带来的挑战研究[J]. 软件导刊，2022，21（9）：135-140. [9] ZHENG X, WEI C, WANG S, et al. Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments [C].PROCEEDINGS OF 2024 39TH ACM/IEEE INTERNATIONAL CONFERENCE ON AUTOMATED SOFTWARE ENGINEERING, ASE 2024. Canada,2024:1990-2001.

Related Articles 15

[1]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 2-5.
[2]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 6-9.
[3]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 10-13.
[4]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 14-17.
[5]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 18-21.
[6]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 22-25.
[7]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 26-28.
[8]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 29-31.
[9]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 32-35.
[10]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 36-39.
[11]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 40-44.
[12]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 45-48.
[13]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 49-51.
[14]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 52-55.
[15]	. [J]. Journal of Information Security Reserach, 2026, 12(E1): 56-59.

开源软件供应链中第三方组件检测研究

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics