Software Composition Analysis for Library Popularity Estimations

Modern software development heavily relies on third-party components, causing an increasing dependence of applications on complex ecosystems of libraries and frameworks. Each additional dependency introduces software supply chain risks, yet determining the real-world impact of vulnerable libraries remains challenging because deploy-time usage and exposure are often opaque. While library popularity assessment can support impact estimation, this dissertation first demonstrates that commonly used quantitative popularity metrics for this task are unreliable and susceptible to spoofing. Motivated by these limitations, the work investigates remote software composition analysis methods that enable non-invasive privacy-respecting measurements of deployed software components in the wild. Exemplary for the scenario of artifact analysis, techniques for version detection of JavaScript packages embedded in bundles are developed and evaluated. By addressing static code transformations as central challenge, the proposed approach Aletheia substantially improves correct detections compared to the current state of the art. For opaque box analysis, the dissertation then conceptually examines existing automated dynamic testing approaches with respect to their ability to reveal distinct bugs and functional differences in TLS libraries. Crucially, it shows that the metrics used for evaluation diverge from the approaches' capabilities to achieve their desired objective. This presents a central challenge when trying to compare the different methods. Finally, the dissertation investigates how to move beyond TLS application fingerprints toward TLS library fingerprints for popularity assessment. Utilizing the insights from the analysis of dynamic testing approaches, it proposes leveraging the fundamental idea of specification-guided testing due to its explainability and configuration stability. These properties critically combat well-known challenges for automated fingerprint creation. In controlled lab settings, the proposed fingerprint method TLSident exhibits solid performance, significantly improving the recall of the baseline approach. Subsequent Internet measurements demonstrate the general utility of TLS library fingerprinting algorithms, while plausibility checks indicate that further methodological improvements are required for robust deployment. Overall, the dissertation proves that remote software composition analysis techniques can meaningfully support library popularity assessments and, therefore, vulnerability impact estimation. In addition, the proposed measurement-driven methods are unlikely to be as exposed to spoofing as traditional quantitative popularity metrics, rendering them a more robust basis for decision-making in many current scenarios.