Third-party library (TPL) reuse may introduce vulnerable or malicious code and expose the software, which exposes them to potential risks. Thus, it is essential to identify third-party dependencies and take immediate corrective action to fix critical vulnerabilities when a damaged reusable component is found or reported. However, most of the existing methods only rely on syntactic features, which results in low recognition accuracy and significantly discounts the detection performance by obfuscation techniques. In addition, a few semantic-based approaches face the efficiency problem. To resolve these problems, we propose and implement a more precise and scalable TPL detection method BBDetector. In addition to syntactic features, we consider the rich function-level semantic features and form a feature vector for each function. Moreover, we design a scalable function vector similarity search method to identify anchor functions and the candidate libraries, based upon which we carry out TPL detection. The experiment results demonstrate that BBDetector outperforms B2SFinder and ModX in terms of effectiveness, efficiency, and obfuscation-resilient capability. For the nix binaries, the F1-score of BBDetector is 1.11% and 11.21% higher than that of ModX and B2SFinder, respectively. Moreover, for the Ubuntu binaries, the F1-score of BBDetector is 1.32% and 14.93% is higher than that of ModX and B2SFinder, respectively. And in terms of efficiency, the detection time of BBDetector is only 30.02% of ModX. Besides, for the obfuscation-resilient capability, BBDetector is much stronger than B2SFinder. BBDetector achieves a F1-score of 71%, slightly lower than the F1-score of 77% achieved with the non-obfuscated binary programs. However, B2SFinder only achieves an F1-score of 28%, much lower than that of 67% achieved with the non-obfuscated binary programs.

Advanced Persistent Threat (APT) attacks pose significant threats to critical infrastructure security due to their sophisticated techniques and prolonged nature. Effective network traceability and attack source identification are crucial for mitigating these threats. Time-based network flow watermarking has emerged as a promising approach for tracing APT attacks. However, existing time-based methods face limitations, including reliance on predefined temporal parameters that reduce adaptability to diverse traffic patterns, detectability due to absolute inter-packet delay (IPD) extensions, and sensitivity to network timing fluctuations that affect reliability. To address these challenges, we propose ADIPD, an adaptive watermarking scheme that leverages relative temporal relationships. Our core innovation lies in windowed IPD modulation, where traffic is divided into chronologically ordered windows, and watermarks are embedded by regulating the relative differences between average IPDs of strategically positioned sub-windows. Additionally, a delay minimization strategy compresses IPDs in sub-windows with lower average delays, enhancing both stealthiness and robustness. Experimental results demonstrate that ADIPD outperforms classical methods (WBIPD, IBW, ICBW) in robustness, invisibility, and practicality, achieving higher watermark extraction accuracy under temporal interference while requiring fewer packets and shorter embedding times. This work advances network flow watermarking technology by balancing robustness, stealth, and adaptability, offering a scalable solution for tracing sophisticated cyberattacks.