Datasets & Resources

        To address the challenge of identifying Third-Party Libraries (TPLs) without a standardized package manager or direct SBOM, we utilized a file-path mapping technique inspired by previous work. We filtered repositories based on paths containing keywords such as "/third\_party", "/3rdparty", and "/deps", identifying 3,386 TPLs.  The list of Ground Truth Dataset can be found here.

However, as pointed out by the reviewer, the TPL that are not in our target path (e.g., /3rdparty, /deps) would be left out in ground truth labeling, and finally cause a False Positive in the detection. Since then, we have manually reviewed our False Positive cases. Among these 649 cases of FP, we found that 5.7% (37 cases) were mis-detected. They were correctly detected by SCA tools but unlabeled in the ground truth. After correcting the ground truth, the precision and recall of OSSScope have improved to 84.34% and  97.34%. The revised ground truth can be found here.

Based on the results of OSSScope, we trained a classification model, named RClassifier, to simplify the repository collecting process. It determines whether a certain repository is to be collected or not based on these metrics: stars, forks, open issues, commits, contributors and action period (the days from the created date to the updated time). The original model can be found here. We also provide a demo to show how to use RClassifier, which can be found here.