Tiver: Identifying Adaptive Versions of C/C++ Third-Party Open-Source Components Using a Code Clustering Technique

Reusing open-source software (OSS) provides significant benefits but also poses risks from propagated vulnerabilities. While tracking OSS component versions helps mitigate threats, existing approaches typically map a single version to the reused codebase. This coarse-grained approach overlooks the coexistence of multiple versions, leading to ineffective OSS management. Moreover, identifying component versions is further complicated by noise codes, such as shared algorithmic code across different OSS, and duplicate components caused by redundant OSS reuse. In this paper, we introduce the concept of the adaptive version, a one-stop solution to represent the version diversity of reused OSS. To identify adaptive versions, we present Tiver, which employs two key techniques: (1) fine-grained function-level versioning and (2) OSS code clustering to identify duplicate components and remove noise. This enables precise identification of OSS reuse locations and adaptive versions, effectively mitigating risks associated with OSS reuse. Evaluation of 2,025 popular C/C++ software revealed that 67% of OSS components contained multiple versions, averaging over three versions per component. Nonetheless, Tiver effectively identified adaptive versions with 88.46% precision and 91.63% recall in duplicate component distinction, and 86% precision and 86.84% recall in eliminating noise, while existing approaches barely achieved 42% recall in distinguishing duplicates and did not address noise. Further experiments showed that Tiver could enhance vulnerability management and be applied to Software Bills of Materials (SBOM) to improve supply chain security.