English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

To address security vulnerabilities arising from third-party libraries,security researchers maintain databases monitoring and curating vulnerabilityreports. Application developers can identify vulnerable libraries by directlyquerying the databases with their used libraries. However, the querying resultsof vulnerable libraries are not reliable due to the incompleteness ofvulnerability reports. Thus, current approaches model the task of identifyingvulnerable libraries as a named-entity-recognition (NER) task or an extrememulti-label learning (XML) task. These approaches suffer from highly inaccurateresults in identifying vulnerable libraries with complex and similar names,e.g., Java libraries. To address these limitations, in this paper, we proposeVulLibMiner, the first to identify vulnerable libraries from textualdescriptions of both vulnerabilities and libraries, together with VulLib, aJava vulnerability dataset with their affected libraries. VulLibMiner consistsof a TF-IDF matcher to efficiently screen out a small set of candidatelibraries and a BERT-FNN model to identify vulnerable libraries from thesecandidates effectively. We evaluate VulLibMiner using fourstate-of-the-art/practice approaches of identifying vulnerable libraries onboth their dataset named VeraJava and our VulLib dataset. Our evaluationresults show that VulLibMiner can effectively identify vulnerable librarieswith an average F1 score of 0.657 while the state-of-the-art/practiceapproaches achieve only 0.521.

Identifying Vulnerable Third-Party Java Libraries from Textual Descriptions of Vulnerabilities and Libraries