A fine-grained vulnerability propagation detection method and system for Maven ecosystem

Abstract

The present invention discloses a fine-grained vulnerability propagation detection method and system for the Maven ecosystem. The present invention proposes a novel data structure called a flattened function call graph to store the function call relationship of each software package, and identifies the package dependency chain related to vulnerability propagation based on the dependency graph of the software package to be analyzed, and generates a flattened function call graph for each software package on the chain and then splices them. Then, based on the special structure of the flattened function call graph, a fast vulnerability function call path search method is proposed, which realizes fast function call path search by first performing a fast reachability judgment and then restoring the complete function call path in a single package, thereby realizing the analysis of vulnerability propagation at the function granularity. The present invention realizes rapid and large-scale vulnerability propagation analysis in the Maven ecosystem, which can be used for vulnerability risk judgment of user projects, and can also be used for large-scale analysis and research at the ecosystem level, and is highly practical.

Description

Technical Field

[0001] The present invention relates to a vulnerability propagation analysis method in the field of software supply chain security, and more specifically, to a method and system for identifying and analyzing vulnerability propagation paths in software packages in the Maven ecosystem. Background Art

[0002] Software reuse greatly facilitates modern software development. Java developers can easily use the Maven package manager to obtain reusable libraries, allowing them to quickly build their own projects. For example, developers can use the Tomcat library in the Maven ecosystem to build a web server. Numerous third-party libraries form a vast software ecosystem, creating a complex dependency structure. While a package may have only a few direct dependencies, it is likely to have numerous transitive dependencies. Complex dependency relationships not only increase the burden on developers to maintain projects but also provide a channel for the spread of vulnerabilities. Through inter-package dependencies, a vulnerability in one package can propagate to another. Consequently, inter-package dependencies amplify the impact of a vulnerability, allowing a vulnerability in one package to pose a threat to the entire ecosystem. For example, a recently discovered vulnerability in Apache Log4j2 affected 8% of the entire Maven ecosystem. To mitigate the threat of vulnerabilities, academia and industry have developed a variety of vulnerability propagation analysis tools to identify vulnerabilities in project dependencies and assess their threat to the current project, thereby helping people develop effective countermeasures.

[0003] Traditional vulnerability propagation analysis primarily operates at the package level, using dependency chains between packages to identify all downstream packages affected by a vulnerable package. However, while some downstream packages may depend on a vulnerable package, they do not necessarily call the vulnerable function and are not affected by the vulnerability, resulting in significant errors in this approach. Recent research has proposed advancing vulnerability propagation analysis to the function level. However, existing work still relies on traditional function call graph generation and path search methods, or requires the integration of dynamic analysis methods, which are inefficient, slow, and unsuitable for large-scale analysis. Therefore, large-scale vulnerability propagation analysis at the function level remains an area of ​​research.

[0004] There are at least the following problems in the prior art:

[0005] First, the existing technology lacks a method for quickly generating function call graphs. Existing technologies rely on traditional static analysis solutions. Generating a function call graph requires a significant amount of time and memory to analyze call relationships due to the numerous dependencies. Furthermore, after generating the function call graph, searching for function call paths requires repeated path traversal within the massive function call graph. This process is highly time-consuming and difficult to find all complete function call paths in a short period of time. Furthermore, the large number of function call paths found makes complete analysis difficult.

[0006] Therefore, for the Maven ecosystem, a fine-grained vulnerability propagation detection method is needed to achieve rapid vulnerability risk assessment and repair method recommendations. Summary of the Invention

[0007] In view of the deficiencies of the prior art, the purpose of the present invention is to provide a fine-grained vulnerability propagation detection method for the Maven ecosystem. The present invention proposes for the first time a novel data structure, called a flattened function call graph, which uses a two-layer structure consisting of entry functions and reachable functions to store function call relationships and class hierarchy information within Java software packages in the Maven ecosystem. Then, based on the dependency relationships of the software packages to be analyzed in the ecosystem, the method screens out dependencies related to vulnerability propagation and generates a flattened function call graph for each software package. Finally, the method combines the flattened function call graphs of multiple software packages and proposes a method called fast vulnerability reachability judgment based on flattened function call graphs, which checks the reachability of each entry function of the software package to the vulnerability function, and then searches for the function call path from them to the vulnerability function. The final report obtains the vulnerability call path from the software package to be tested to the vulnerability function.

[0008] The technical solutions of the present invention are as follows:

[0009] 1. A fine-grained vulnerability propagation detection method for the Maven ecosystem

[0010] Get the dependency graph of the target package in the Maven ecosystem;

[0011] Generate a package dependency chain from the target software package to the vulnerable dependency based on the dependency graph;

[0012] For all packages in the package dependency chain, build a flattened function call graph corresponding to each package;

[0013] Based on the flattened function call graph of each software package, the function call path within and across packages from the target software package to the software package where the vulnerability function is located is generated, thereby obtaining the vulnerability propagation path of the target software package.

[0014] The flattened function call graph of each software package is constructed by:

[0015] Get all entry functions of the current software package;

[0016] For each entry function, obtain the intermediate representation of the current entry function, analyze the intermediate representation line by line to obtain all functions called in the current entry function except other entry functions, and form the reachable function list of the current entry function; traverse and process other entry functions to obtain the reachable function lists corresponding to other entry functions. Each entry function and its reachable function list are organized into a key-value pair structure, thus forming the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types.

[0017] The method generates, based on the flattened function call graph of each software package, a function call path within and across packages from the target software package to the software package where the vulnerable function is located, thereby obtaining the vulnerability propagation path of the target software package, including:

[0018] Use class hierarchy information to determine the reachability of vulnerable functions for each software package, obtain a list of all actually reachable functions for the current package and a list of the actual entry functions for the next package, and obtain the cross-package function call path for the current package. Based on the package dependency chain, determine the reachability of vulnerable functions for each software package in turn until the last package is reached, obtaining all cross-package function call paths.

[0019] Based on the actual entry function list and all actually reachable function lists of each software package, the intra-package function call path of each software package is generated. After traversing and processing each software package, the intra-package function call paths corresponding to different software packages are obtained, and then the vulnerability propagation path of the target software package is obtained.

[0020] After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, the vulnerable functions that may be called by the entry function in the target software package are obtained.

[0021] For the actual entry function list of each software package, obtain the reachable function list of each actual entry function and record it as the possible reachable function list. After intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package. Then traverse and process other actual entry functions in the current software package to obtain all actual reachable function lists of the current software package and the actual entry function list of the next software package.

[0022] In the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information to obtain a reachable call function list. After intersecting the reachable call function list with the entry function list of the next software package, the actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

[0023] The step of generating the function call path within each software package based on the actual entry function list and all actually reachable function lists of each software package includes:

[0024] Search the path between each actual entry function and the corresponding actual reachable function list. After traversing and processing all actual entry functions, obtain all paths of the current software package, thereby obtaining a flattened function call path and recording it as the function call path within the package.

[0025] 2. A fine-grained vulnerability propagation detection system for the Maven ecosystem

[0026] A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package based on the function call relationship and class hierarchy structure in each software package on the package dependency chain;

[0027] The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, thereby obtaining the vulnerability propagation path of the target software package.

[0028] 3. A computer device

[0029] The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem when executing the computer program.

[0030] 4. A Computer-Readable Storage Medium

[0031] The medium stores a computer program, which, when executed by a processor, implements the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem.

[0032] In general, the beneficial effects of the present invention are:

[0033] 1) Fast Function Call Graph Construction: This paper introduces the concept of a flattened function call graph for the first time. This splits the functions in a software package into entry functions and reachable functions, storing the list of reachable functions corresponding to the entry functions in a key-value pair format. This allows for a separate function call graph to be generated for each software package, replacing the traditional graph-based storage of function call relationships. This method also preserves class hierarchy information and enables the concatenation of multiple flattened function call graphs, rather than generating a single function call graph containing all dependencies as traditional methods do. This enables parallel generation and reuse of function call graphs.

[0034] 2) Low-cost cross-package function call path search: The flattened function call graph proposed in this invention divides functions within a software package into two categories: entry functions and reachable functions. Based on this structure, path traversal within the software package can be avoided, and reachable functions across packages can be directly retrieved. Based on the class hierarchy and call type of each package, the function call graphs of different software packages can be automatically spliced ​​together to achieve flexible cross-package function call path search.

[0035] 3) Fast vulnerability reachability judgment: This paper proposes for the first time a fast vulnerability function reachability judgment method based on a flattened function call graph, which aggregates multiple functions in each software package into one unit. Without outputting the specific function call path, it avoids the backtracking and recursive operations required for path traversal to quickly give the reachability of the vulnerable function to the specified entry function.

[0036] 4) Full function call path search by package: The entry and exit points of each package are searched based on the flattened function call graph. The full path is searched in each package's own function call graph, rather than searching the traditional function call graph that includes all dependencies. This splits the task of searching from the starting point function to the vulnerable function in a large function call graph into searching the starting and ending points in multiple subgraphs and then concatenating them, effectively reducing complexity.

[0037] 5) Comprehensive and accurate vulnerability propagation analysis: The method proposed in this invention can quickly find all function call paths from a specified entry function to a vulnerable function, rather than just partial paths or the shortest path. Therefore, it can help software developers or researchers grasp the complete laws of vulnerability propagation and conduct comprehensive vulnerability propagation analysis.

[0038] 6) Good compatibility and versatility: It can process both Java source code and compiled Java bytecode files. Intermediate results are stored in JSON format on disk and can be shared and reused.

[0039] In summary, the present invention has a good prospect for promotion and application. It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0041] Figure 1 It is a hierarchical structure diagram showing the vulnerability propagation analysis method proposed in this invention, which includes two parts: flattened function call graph generation and function call path search.

[0042] Figure 2 The figure is a schematic diagram showing construction of a flattened function call graph for a single package according to an exemplary embodiment.

[0043] Figure 3 The figure is a schematic diagram showing construction of a flattened function call graph for multiple packages according to an exemplary embodiment.

[0044] Figure 4 The figure is a schematic diagram showing a vulnerability reachability analysis for a packet according to an exemplary embodiment. DETAILED DESCRIPTION

[0045] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numerals in different drawings represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present invention.

[0046] The terms used in this invention are for the purpose of describing specific embodiments only and are not intended to limit the invention. The singular forms "a," "the," and "the" used in this invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0047] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0048] On the one hand, the present invention proposes a fine-grained vulnerability propagation detection method for Maven ecology, such as Figure 1 As shown, the method includes:

[0049] Get the dependency graph of the target package in the Maven ecosystem, such as Figure 3 As shown;

[0050] Based on the dependency graph, a package dependency chain is generated from the target software package to the vulnerable dependency (i.e., the software package where the vulnerable function may be located);

[0051] For all packages in the package dependency chain, build a flattened function call graph corresponding to each package;

[0052] Figure 2 (a) is the traditional function call graph. Figure 2 As shown in (b), the flattened function call graph of each software package is constructed by:

[0053] Get all entry functions of the current software package;

[0054] For each entry function, obtain the intermediate representation (IR) of the current entry function, analyze the intermediate representation line by line to obtain all functions called in the current entry function except other entry functions, and form the reachable function list of the current entry function; traverse and process other entry functions to obtain the reachable function lists corresponding to other entry functions. Each entry function and its reachable function list are organized into a key-value pair structure, thus forming the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types.

[0055] In the specific implementation, for each entry function, a new queue is created and all entry functions are added to the queue; each time an entry function is taken out of the queue, the intermediate representation (IR) of the entry function is obtained, and it is analyzed line by line to find all other functions called in the function body and add them to the reachable function list corresponding to the entry function, and the entry function and its reachable function list are organized in key-value form; the operation is repeated until the queue is empty, and the key-value pair structure of all entry functions is obtained, thereby obtaining the main body of the flattened function call graph for the next step of path search.

[0056] Based on the flattened function call graph of each software package, we generate the intra-package and cross-package function call paths from the target software package to the software package where the vulnerable function resides, thereby obtaining the vulnerability propagation path of the target software package. Specifically, we include:

[0057] Use the class hierarchy information to determine the reachability of the vulnerable function for each software package, obtain the list of all actually reachable functions of the current software package and the actual entry function list of the next software package, and obtain the cross-package function call path of the current software package; Based on the package dependency chain, determine the reachability of the vulnerable function for each software package in turn until the last software package is reached, and obtain all cross-package function call paths, such as Figure 4 As shown;

[0058] Based on the actual entry function list and all actually reachable function lists of each software package, the intra-package function call path of each software package is generated. After traversing and processing each software package, the intra-package function call paths corresponding to different software packages are obtained, and then the vulnerability propagation path of the target software package is obtained.

[0059] After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, we can obtain the vulnerable functions that may be called by the entry function in the target software package.

[0060] For the actual entry function list of each software package, the actual entry function list of the target software package is all entry functions, and the actual entry function list of other software packages is a list of entry functions after intersection processing with the possible reachable function list of the previous software package; obtain the reachable function list of each actual entry function and record it as the possible reachable function list, and after intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package; traverse and process other actual entry functions in the current software package to obtain all actual reachable function lists of the current software package and the actual entry function list of the next software package.

[0061] Among them, in the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, that is, when processing cross-package function calls, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information. For example, when static calls (static invoke), the function in the parent class is automatically searched, and when virtual calls (virtual invoke) and interface calls (interface voke) are automatically searched for possible subclass functions, thereby obtaining a reachable call function list. After intersecting the reachable call function list with the entry function list of the next software package, the actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

[0062] Based on the actual entry function list and all actually reachable function lists of each software package, the function call path within each software package is generated, including:

[0063] Search the path between each actual entry function (i.e., the starting point) and the corresponding actual reachable function list (i.e., the end point). After traversing and processing all actual entry functions, all paths of the current software package are obtained, thereby obtaining a flattened function call path and recording it as the function call path within the package.

[0064] On the other hand, the present invention also proposes a fine-grained vulnerability propagation detection system for the Maven ecosystem, including:

[0065] A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package based on the function call relationship and class hierarchy structure in each software package on the package dependency chain;

[0066] The flattened function call graph construction module proposed in this invention simplifies function call graph storage at both the cross-package and intra-package levels. First, this invention can focus solely on dependencies relevant to vulnerability propagation, ignoring other irrelevant dependencies. Second, a function call graph can be generated for each dependency. When searching for function call paths across packages, the function call graphs of the dependencies involved can be concatenated to perform a cross-package vulnerability function call path search.

[0067] This module first defines functions within a software package into two categories: entry-point functions and reachable functions. An entry-point function refers to a package's publicly exposed API, representing the package's entry point to the outside world. In Java, entry-point functions are defined based on function modifiers. If a function and its class are not private, they are marked as entry-point functions. All functions that can be called directly or indirectly from a given entry-point function are called reachable functions of that entry-point function.

[0068] To construct a flattened function call graph for a single package, we first traverse all classes and functions, then examine their modifiers to find all entry-point functions (functions whose attributes are not private). For each entry-point function, we then use a breadth-first search to find all reachable functions, both directly and indirectly. After completing the reachable function search for all entry-point functions, we organize all entry-point functions and their reachable functions into a key-value pair structure, forming the body of the flattened function call graph for the single package. We also record the class hierarchy information for the package. For multiple packages, we first determine the package dependency chain from the target package to the vulnerable function, and then construct a flattened function call graph for each package in that dependency chain. These flattened function call graphs contain the class hierarchy information and cross-package function call types within their respective packages and can be pieced together to recover the global class hierarchy information.

[0069] The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, thereby obtaining the vulnerability propagation path of the target software package.

[0070] The vulnerability function call path search module proposed in the present invention utilizes the flattened function call graph generated by the flattened function call graph construction module to search for all function call paths from the specified entry to the vulnerability function. The design compresses the complex function call relationship within a package into two layers: the entry function and the reachable function. Therefore, for a package dependency chain of length n, the deepest recursive stack depth when searching for a path is only 2n. The significantly reduced depth of the call stack during path search can greatly accelerate the path search process. However, on the whole, path search is still a complex task because it requires traversing a large number of paths. In particular, although the flattened function call graph has a shallow depth, each entry function usually has many reachable functions, that is, the depth is shallow but the width is wide, so there are still many combinations that need to be traversed, which means that its time overhead can be further compressed.

[0071] To address this problem, the module's basic design concept uses rapid reachability analysis to determine whether an entry point function is likely to trigger a vulnerable function. It then searches for specific function call paths, reducing the overall task complexity by splitting the overall task into separate package-level path searches. To achieve this goal, the present invention first introduces a new method, called "Fast Vulnerability Reachability Determination Based on a Flattened Function Call Graph," to quickly determine whether a given entry point or multiple entry points are likely to call a vulnerable function without traversing numerous paths. This method performs a low-cost vulnerability function reachability check for each entry point function. This eliminates the need for complex path searches for each entry point function. Instead, it ignores entry points that are unreachable and only initiates path searches for those entry points that are determined by the fast vulnerability reachability determination based on the flattened function call graph to be likely to reach the vulnerable function, thereby narrowing the search scope and achieving acceleration. In actual operation, it was observed that 97% of entry points were unreachable, indicating that this method can achieve significant pruning. For each entry point function that could potentially reach the vulnerable function, a traditional depth-first search (DFS) algorithm is used to find all flattened function call paths from the target package's entry point function to the vulnerable function in the vulnerable dependency. For each flattened function call path, a traditional function call graph containing only the function calls of each dependency is searched for the path between the starting point and the end point in each package. The specific path results from each package are concatenated to form a complete function call path. After processing all flattened function call paths from all entry points, the final output is obtained.

[0072] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the contents disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein.

[0073] It will be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A fine-grained vulnerability propagation detection method for Maven ecosystem, characterized by: include: Get the dependency graph of the target package in the Maven ecosystem; Generate a package dependency chain from the target software package to the vulnerable dependency based on the dependency graph; For all packages in the package dependency chain, build a flattened function call graph corresponding to each package; Based on the flattened function call graph of each software package, the function call path within and across packages from the target software package to the software package where the vulnerable function is located is generated, thereby obtaining the vulnerability propagation path of the target software package; The flattened function call graph of each software package is constructed by: Get all entry functions of the current software package; For each entry point function, obtain the intermediate representation of the current entry point function, analyze the intermediate representation line by line, obtain all functions called in the current entry point function except other entry points, and form the reachable function list of the current entry point function; traverse and process other entry points to obtain the reachable function lists corresponding to other entry points. Each entry point function and its reachable function list are organized into a key-value pair structure, thus forming the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types. The method generates, based on the flattened function call graph of each software package, a function call path within and across packages from the target software package to the software package where the vulnerable function is located, thereby obtaining the vulnerability propagation path of the target software package, including: Use class hierarchy information to determine the reachability of vulnerable functions for each software package, obtain a list of all actually reachable functions for the current package and a list of the actual entry functions for the next package, and obtain the cross-package function call path for the current package. Based on the package dependency chain, determine the reachability of vulnerable functions for each software package in turn until the last package is reached, obtaining all cross-package function call paths. Based on the actual entry function list and all actually reachable function lists of each software package, the internal function call path of each software package is generated. After traversing each software package, the corresponding internal function call paths of different software packages are obtained, and then the vulnerability propagation path of the target software package is obtained. For the actual entry function list of each software package, obtain the reachable function list of each actual entry function and record it as the possible reachable function list. After intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package. Then traverse and process other actual entry functions in the current software package to obtain all actual reachable function lists of the current software package and the actual entry function list of the next software package.

2. A fine-grained vulnerability propagation detection method for Maven ecology according to claim 1, characterized in that: After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, the vulnerable functions that may be called by the entry function in the target software package are obtained.

3. A fine-grained vulnerability propagation detection method for Maven ecology according to claim 1, characterized in that: In the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information to obtain a reachable call function list. After intersecting the reachable call function list with the entry function list of the next software package, the actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

4. A fine-grained vulnerability propagation detection method for Maven ecology according to claim 1, characterized in that: The step of generating the function call path within each software package based on the actual entry function list and all actually reachable function lists of each software package includes: Search the path between each actual entry function and the corresponding actual reachable function list. After traversing and processing all actual entry functions, obtain all paths of the current software package, thereby obtaining a flattened function call path and recording it as the function call path within the package.

5. A fine-grained vulnerability propagation detection system for Maven ecology for implementing the method of claim 1, characterized in that: include: A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package based on the function call relationship and class hierarchy structure in each software package on the package dependency chain; The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, thereby obtaining the vulnerability propagation path of the target software package.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem as described in any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem as described in any one of claims 1 to 4 are implemented.

Images