Abstract:Currently, little is known about the structure of the Cargo ecosystem and the potential for vulnerability propagation. Many empirical studies generalize third-party dependency governance strategies from a single software ecosystem to other ecosystems but ignore the differences in the technical structures of different software ecosystems, making it difficult to directly generalize security governance strategies from other ecosystems to the Cargo ecosystem. To fill the gap in this area, this paper constructs a knowledge graph of dependency vulnerabilities for the Cargo ecosystem using techniques related to knowledge graphs to address this challenge. This paper is the first large-scale empirical study in a related research area to address vulnerability propagation in the Cargo ecosystem. This paper proposes a dependency-vulnerability knowledge graph parsing algorithm to determine the vulnerability propagation path and propagation range and empirically studies the characteristics of vulnerabilities in the Cargo ecosystem, the propagation range, and the factors that cause vulnerability propagation. Our research has found that the Cargo ecosystem's security vulnerabilities are primarily memory-related. 18% of the libraries affected by the vulnerability is still affected by the vulnerability in the latest version of the library. The number of versions affected by the propagation of the vulnerabilities is 19.78% in the entire Cargo ecosystem. This paper looks at the characteristics and propagation factors triggering vulnerabilities in the Cargo ecosystem. It provides some practical resolution strategies for administrators of the Cargo community, developers who use Cargo to manage third-party libraries, and library owners. This paper provides new ideas for improving the overall security of the Cargo ecosystem.

Open Source Software Vulnerability Propagation Analysis Algorithm Based on Knowledge Graph.

A Software Vulnerability Detection Method Based on Complex Network Community

Refining Traceability Links Between Vulnerability and Software Component in a Vulnerability Knowledge Graph.

Using Program Knowledge Graph to Uncover Software Vulnerabilities

Profile of Vulnerability Remediations in Dependencies Using Graph Analysis

An Open Source Software Defect Detection Technique Based on Homology Detection and Pre-identification Vulnerabilitys

A software vulnerability detection method based on deep learning with complex network analysis and subgraph partition

Cargo Ecosystem Dependency-Vulnerability Knowledge Graph Construction and Vulnerability Propagation Study

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Software Knowledge Graph Building Method for Open Source Project

A Mining Approach to Obtain the Software Vulnerability Characteristics

The Vulnerability Relationship Prediction Research for Network Risk Assessment

A Large-Scale Empirical Study on Vulnerability Distribution Within Projects and the Lessons Learned

Survey of Source Code Vulnerability Analysis Based on Deep Learning

Research on Automatic Generation and Analysis Technology of Network Attack Graph

A Probability-Based Approach to Attack Graphs Generation

Software vulnerable functions discovery based on code composite feature

Code Vulnerability Detection Based on Deep Sequence and Graph Models: A Survey

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

A Component-Centric Access Graph Based Approach to Network Attack Analysis