JDetect: A Fine-Grained Detecting Method for Java Source SCA by Fusing Behavioral and Code Features
Accurate identification of open-source software (OSS) reuse relationships is a prerequisite for effective software supply chain management. Source software composition analysis (SSCA) techniques analyze repository source code to identify such relationships. However, existing SSCA methods lack industrial validation for the Java language. They typically rely on single version-based features, and neglect developers' integration habits. These limitations lead to poor detection robustness and limited traceability. To address these issues, we propose JDetect, a Java SSCA method that fuses behavioral and code features for fine-grained traceability. JDetect extracts multi-dimensional code features from OSS functions to construct a component database. JDetect combines hash fingerprints, vector sorting, and developer behavior patterns to detect reused components and trace them at the commit level. Experimental results on real-world industrial Java projects show that JDetect achieves an F1 score of 85.41% in OSS component identification, representing an improvement of approximately 10% over the baseline. In the OSS tracking task, 97.47% of the identified components are traced to their optimal locations. In addition, JDetect demonstrates high efficiency, with an average detection time of 66.74 seconds per repository. Overall, JDetect provides a precise and efficient SSCA solution for managing software supply chains in industrial settings.