LibXSub: A Framework for Detecting Binary Third-Party Library Reuse Regions Based on Explanatory Subgraphs

Abstract

Binary third-party library detection is a fundamental task in software composition analysis, vulnerability tracing, and software supply chain security. Existing approaches mainly rely on function-level matching or global similarity computation, while paying insufficient attention to region-level reuse structures formed by function call relationships. Moreover, their detection results generally lack interpretability. To address these limitations, this paper proposes LibXSub, an explainable subgraph-based framework for binary third-party library reuse region detection. Based on function call graphs, LibXSub integrates instruction operation features and control-flow structural features of function nodes, and employs a Siamese graph neural network to compute the structural-semantic similarity between target candidate regions and candidate library regions, enabling region-level third-party library reuse detection. To improve interpretability, LibXSub introduces an explainable subgraph generation mechanism that identifies critical call relationships through edge masks and characterizes the contribution of different function feature dimensions to region similarity prediction through node feature masks. Experimental results show that LibXSub achieves F1-scores of 0.900 and 0.877 on Dataset_1 and Dataset_2, respectively, outperforming existing methods. Furthermore, it generates compact explanatory subgraphs while maintaining high explanation fidelity, demonstrating the effectiveness of the proposed framework for both region-level third-party library reuse detection and result interpretation.