Security Analysis for Third-Party Component Dependency Confusion: A Risk Assessment Framework Based on Source Code Tree Matching

With the widespread use of third-party components in software development, their security has become a major challenge in software security. The implantation of malicious components or security weak components unintentionally referenced by developers may lead to serious security problems. In order to effectively solve the dependency obfuscation problem, this paper proposes a detection framework (Comchecker) based on source code analysis to cope with the dependency obfuscation problem through source code analysis techniques. The framework first accurately identifies and builds the code trees of third-party components and optimizes them through static analysis of component source codes. Then, it evaluates the security risk of the component by designing a comprehensive assessment model that combines multiple factors such as the component's origin, structural characteristics, and historical vulnerability information. Subsequently, we conduct a series of experiments to evaluate the proposed framework and compare it with state-of-the-art component detection tools. The results show that our detection framework achieves 93.51% accuracy for third-party component detection, outperforms existing detection tools in terms of detection accuracy and precision, and achieves 91.04% accuracy for obfuscation-dependent detection. Finally, Comchecker is also well extended to be applied to components used in most mainstream development languages.