Bytecode-centric Detection of Known-to-be-vulnerable Dependencies in Java Projects

TL;DR

This paper tackles the security risks posed by open-source dependencies in Java, where metadata-based approaches may miss or delay vulnerability detection. It introduces Jaralyzer, a bytecode-centric dependency scanner that relies on fix-commit–derived knowledge embedded in bytecode, enabling robust detection even when dependencies are recompiled, repackaged, or otherwise modified. Through a two-stage process—knowledge-base creation from compileable fixes and a triplet-based code analysis of dependency bytecode—Jaralyzer achieves high coverage across multiple modification types and outperforms state-of-the-art scanners in both modified and unmodified scenarios, while maintaining favorable runtime performance. The work demonstrates practical impact by improving vulnerability detection accuracy and speed, reducing both false positives and missed cases for Java dependencies in real-world projects.

Abstract

On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code bases. This high degree of OSS reliance comes with a considerable security risk of adding known security vulnerabilities to a code base. To remedy this risk, researchers and companies have developed various dependency scanners, which try to identify inclusions of known-to-be-vulnerable OSS dependencies. However, there are still challenges that modern dependency scanners do not overcome, especially when it comes to dependency modifications, such as re-compilations, re-bundlings or re-packagings, which are common in the Java ecosystem. To overcome these challenges, we present Jaralyzer, a bytecode-centric dependency scanner for Java. Jaralyzer does not rely on the metadata or the source code of the included OSS dependencies being available but directly analyzes a dependency's bytecode. Our evaluation across 56 popular OSS components demonstrates that Jaralyzer outperforms other popular dependency scanners in detecting vulnerabilities within modified dependencies. It is the only scanner capable of identifying vulnerabilities across all the above mentioned types of modifications. But even when applied to unmodified dependencies, Jaralyzer outperforms the current state-of-the-art code-centric scanner Eclipse Steady by detecting 28 more true vulnerabilities and yielding 29 fewer false warnings.

Figures (5)

• Figure 1: Overview of Jaralyzer
• Figure 1: Original class
• Figure 2: Detailed overview of Jaralyzer's compilation step
• Figure 3: Exemplary version history of an OSS project with three fix commits. FC = Fix Commit
• Figure 4: Overview of the experimental setup