{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T21:05:22Z","timestamp":1784581522255,"version":"3.55.0"},"reference-count":81,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100004608","name":"Natural Science Foundation of Jiangsu Province","doi-asserted-by":"publisher","award":["BK20241195"],"award-info":[{"award-number":["BK20241195"]}],"id":[{"id":"10.13039\/501100004608","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62202219"],"award-info":[{"award-number":["62202219"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302210"],"award-info":[{"award-number":["62302210"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Open Project of Key Laboratory of Industry and Information Technology Ministry for Software Fusion Application and Testing Verification","award":["RFT20250301"],"award-info":[{"award-number":["RFT20250301"]}]},{"name":"Science and Technology Development Program of Two Districts in Xinjiang, China","award":["2024LQ03004"],"award-info":[{"award-number":["2024LQ03004"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["ZZKT2025A12"],"award-info":[{"award-number":["ZZKT2025A12"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["ZZKT2025B18"],"award-info":[{"award-number":["ZZKT2025B18"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["ZZKT2025B20"],"award-info":[{"award-number":["ZZKT2025B20"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["ZZKT2025B22"],"award-info":[{"award-number":["ZZKT2025B22"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2025A17"],"award-info":[{"award-number":["KFKT2025A17"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2025A19"],"award-info":[{"award-number":["KFKT2025A19"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2025A20"],"award-info":[{"award-number":["KFKT2025A20"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2024A02"],"award-info":[{"award-number":["KFKT2024A02"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2024A13"],"award-info":[{"award-number":["KFKT2024A13"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2024A14"],"award-info":[{"award-number":["KFKT2024A14"]}]},{"name":"Innovation Projects and Overseas Open Projects of State Key Laboratory for Novel Software Technology, Nanjing University","award":["KFKT2026A18"],"award-info":[{"award-number":["KFKT2026A18"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/tse.2026.3688559","type":"journal-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:49:20Z","timestamp":1777492160000},"page":"2127-2147","source":"Crossref","is-referenced-by-count":0,"title":["Automated Localization of Affected Libraries and Versions from Vulnerability Reports"],"prefix":"10.1109","volume":"52","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-5157-1118","authenticated-orcid":false,"given":"Jinwei","family":"Xu","sequence":"first","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9159-5331","authenticated-orcid":false,"given":"He","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3263-1275","authenticated-orcid":false,"given":"Xin","family":"Zhou","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-8789-4589","authenticated-orcid":false,"given":"Yanjing","family":"Yang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4869-9098","authenticated-orcid":false,"given":"Jinghao","family":"Hu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4088-1846","authenticated-orcid":false,"given":"Xiaokang","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0406-2263","authenticated-orcid":false,"given":"Lanxin","family":"Yang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0146-5411","authenticated-orcid":false,"given":"Bohan","family":"Liu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Novel Software Technology, Software Institute, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639209"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00034"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549125"},{"key":"ref4","first-page":"653","article-title":"LibRadar: Fast and accurate detection of third-party libraries in android apps","volume-title":"Proc. 38th Int. Conf. Softw. Eng. Companion","author":"Ma","year":"2016"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SANER56733.2023.00028"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3114381"},{"key":"ref8","first-page":"1165","article-title":"{MVP}: Detecting vulnerabilities using {Patch-Enhanced} vulnerability signatures","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Xiao","year":"2020"},{"key":"ref9","article-title":"2024 open source security report: Slowing progress and new challenges for DevSecOps.","year":"2024"},{"key":"ref10","article-title":"A log4shell (log4j) retrospective","year":"2022"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09959-3"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3181010"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.38"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME55016.2022.00024"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3657007"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3688806"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3125270"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3717060"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3524610.3527893"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00094"},{"key":"ref21","first-page":"869","article-title":"Towards the detection of inconsistencies in public security vulnerability reports","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Dong","year":"2019"},{"key":"ref22","doi-asserted-by":"crossref","first-page":"90","DOI":"10.1145\/3377813.3381360","article-title":"Automated identification of libraries from vulnerability data","volume-title":"Proc. ACM\/IEEE 42nd Int. Conf. Softw. Eng.: Softw. Eng. Pract.","author":"Chen","year":"2020"},{"key":"ref23","first-page":"1447","article-title":"Vision: Identifying affected library versions for open source software vulnerabilities","volume-title":"Proc. 39th IEEE\/ACM Int. Conf. Autom. Softw. Eng.","author":"Wu","year":"2024"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2015.7332492"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3250479"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639582"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.527"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560437"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616264"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2014.05.019"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483577"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606613"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3624734"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/QRS54544.2021.00060"},{"key":"ref35","article-title":"Seventy-eight percent of companies run on open source, yet many lack formal policies to manage legal, operational, and security risk.\u201d","year":"2015"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.21655\/ijsi.1673-7288.00250"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387461"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2020.110851"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180201"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1858996.1859089"},{"key":"ref41","article-title":"The 2025 open source security and risk analysis report.\u201d","year":"2025"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2018.01.004"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23088-2_15"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.5815\/ijem.2022.04.01"},{"key":"ref45","first-page":"1","article-title":"Analyzing vulnerability databases","volume-title":"Proc. 10th IEEE Int. Conf. Appl. Inf. Commun. Technol.","author":"Aliyev","year":"2016"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3498891.3501259"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/QRS57517.2022.00012"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3498537"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3523284"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103286"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2023.107178"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-024-00922-z"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556933"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00016"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2023.111790"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED57927.2023.10129378"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103477"},{"key":"ref58","first-page":"730","article-title":"Sparse local embeddings for extreme multi-label classification","volume-title":"Proc. 28th Annu. Conf. Neural Inf. Process. Syst.","author":"Bhatia","year":"2015"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2025.3599581"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2025.3537102"},{"key":"ref61","article-title":"Mapping NVD records to their VFCs: How hard is it?","author":"Nguyen","year":"2025"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/0306-4573(88)90021-0"},{"key":"ref63","article-title":"Magic quadrant for application security testing.\u201d","year":"2023"},{"key":"ref64","article-title":"Open source vulnerability schema.\u201d","year":"2025"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-025-09422-z"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3695988"},{"key":"ref67","article-title":"The Llama 3 herd of models","author":"Dubey","year":"2024"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3649590"},{"key":"ref69","first-page":"404","article-title":"TextRank: Bringing order into texts","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Mihalcea","year":"2004"},{"issue":"8","key":"ref70","first-page":"707","article-title":"Binary codes capable of correcting deletions, insertions, and reversals","volume":"10","author":"Levenshtein","year":"1966","journal-title":"Sov. Phys. Doklady"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/SWAT.1973.13"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref73","article-title":"Divide and conquer for large language models reasoning","author":"Meng","year":"2024"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2025.107200"},{"issue":"70","key":"ref75","first-page":"1","article-title":"Scaling instruction-finetuned language models","volume":"25","author":"Chung","year":"2024","journal-title":"J. Mach. Learn. Res."},{"key":"ref76","article-title":"LoRA: Low-rank adaptation of large language models","volume-title":"Proc. 10th Int. Conf. Learn. Representations","author":"Hu","year":"2022"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3703155"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29770"},{"key":"ref79","article-title":"ISO\/IEC 29147:2018.\u201d","year":"2018"},{"key":"ref80","article-title":"ISO\/IEC 30111:2019.\u201d","year":"2019"},{"key":"ref81","article-title":"2024 CVE data review.\u201d","year":"2025"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/32\/11613940\/11495563.pdf?arnumber=11495563","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T20:19:42Z","timestamp":1784578782000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11495563\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":81,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tse.2026.3688559","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7]]}}}