Demo Data from EDBT 2026 / reviewers in the wild / expert
Hongshan Tang
dblp:426/3776
· DBLP profile ↗
1ranked-venue papers
0as first author
1since 2021 · last 2025
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Software engineering, systems software and programming languages · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
1 paper |
Systems and software security · 100% | |
| Software engineering, system software, and programming languages
1 paper |
Software maintenance and evolution · 100% |
Topics — the 3 heaviest of 3, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Systems and software security
software supply chain security |
0.9 | 1 | 2025 | Securing Self-Managed Third-Party Libraries · ASE 2025 |
Systems and software security › software supply chain security
third-party library vulnerability identification |
0.9 | 1 | 2025 | Securing Self-Managed Third-Party Libraries · ASE 2025 |
Software maintenance and evolution › software ecosystems
dependency management |
0.3 | 1 | 2025 | Securing Self-Managed Third-Party Libraries · ASE 2025 |
Methods — techniques the papers use, named apart from their topics
whitelist filtering · 1.7vulnerability report analysis · 1.7
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2025 | Securing Self-Managed Third-Party LibrariesabstractModern software development reuses third-party libraries to cut costs but may introduce vulnerabilities. A critical practice is to verify the security of third-party libraries against public vulnerability reports. Many automated methods have been proposed to identify vulnerable libraries from vulnerability reports. Existing methods are designed for the generic identification of vulnerable libraries, considering the security of all software libraries. Generic identification is inherently challenging, resulting in limited accuracy. However, organizations only consider the security of libraries they trust and use, by self-managing a library whitelist. Therefore, we propose LibGuard, a framework to adapt existing methods to help organizations secure the libraries they use. LibGuard supplies a library whitelist for existing methods and filters the results according to a threshold, facilitating the discovery of risks overlooked by organizations while controlling false alarms. LibGuard is implemented in two ways. The first attaches the whitelist after existing methods. The second integrates the whitelist into existing methods. We evaluated LibGuard using 5,107 vulnerability reports and the library whitelist built from 79 Google projects and 29 Huawei projects. The results show that the two implementations of LibGuard increase the average F1 score by 10.25% and 11.77%, respectively. Moreover, LibGuard performs stably during the extension of whitelists. To our knowledge, this paper is the first study dedicated to securing self-managed third-party libraries, offering insights into adapting generic software security management to self-managed contexts. Xin Zhou 0016, Jinwei Xu, He Zhang 0001, Yanjing Yang, Lanxin Yang, Bohan Liu 0003, Hongshan Tang |
ASE | 7 |