Pre-built Dependency Graph-based TPLs Analysis

The widespread use of importing open-source software (OSS) as third-party libraries (TPLs) in software development has introduced critical open-source security risks. These security risks include vulnerabilities in dependencies, outdated components, and potential license compliance issues. The primary method for mitigating these open-source security risks is Software Composition Analysis (SCA). However, current SCA tools require connections to remote servers and rely on proprietary vulnerability databases to scan projects. To address these issues, this paper proposes a method based on pre-built dependency graphs of popular software packages. Through the Common Platform Enumerations (CPE) conversion algorithm proposed in this paper, this method constructs a localized, lightweight dependency graph, enabling development teams to perform TPLs analysis and vulnerability scanning in a local environment. Experimental results indicate that our proposed method is more efficient while maintaining high accuracy.