Cargo Ecosystem Dependency-Vulnerability Knowledge Graph Construction and Vulnerability Propagation Study
Peiyang Jia (School of Cyber Engineering, Xidian University, China,, National Computer Network Intrusion Protection Center, University of Chinese, Academy of Sciences, China), Chengwei Liu (Nanyang Technological University),, Hongyu Sun (School of Cyber Engineering

TL;DR
This study constructs a dependency-vulnerability knowledge graph for the Cargo ecosystem, analyzing vulnerability propagation, characteristics, and factors to improve security strategies and understanding of ecosystem vulnerabilities.
Contribution
It introduces the first large-scale empirical analysis of vulnerability propagation in the Cargo ecosystem using a novel knowledge graph construction and parsing algorithm.
Findings
Cargo vulnerabilities are mainly memory-related.
18% of libraries remain vulnerable in the latest versions.
19.78% of versions are affected by vulnerability propagation.
Abstract
Currently, little is known about the structure of the Cargo ecosystem and the potential for vulnerability propagation. Many empirical studies generalize third-party dependency governance strategies from a single software ecosystem to other ecosystems but ignore the differences in the technical structures of different software ecosystems, making it difficult to directly generalize security governance strategies from other ecosystems to the Cargo ecosystem. To fill the gap in this area, this paper constructs a knowledge graph of dependency vulnerabilities for the Cargo ecosystem using techniques related to knowledge graphs to address this challenge. This paper is the first large-scale empirical study in a related research area to address vulnerability propagation in the Cargo ecosystem. This paper proposes a dependency-vulnerability knowledge graph parsing algorithm to determine the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Reliability and Analysis Research · Software Engineering Techniques and Practices · Information and Cyber Security
