一句话：提出 CoLeFunDa，结合对比学习与函数级代码变更增强，识别静默漏洞修复并解释其 CWE 与可利用性。
开源软件用户依赖安全公告发现漏洞，但多数漏洞被静默修复，修复提交不含漏洞信息，且修复常早于披露，留下攻击窗口。为尽早感知漏洞，需同时识别静默修复并解释其 CWE 类别与可利用性，但数据有限且多样。本文提出 CoLeFunDa 框架，包含对比学习器与 FunDa 函数级变更数据增强。FunDa 用无监督与有监督策略扩充函数级修复数据；对比学习器训练函数变更编码器 FCBERT，再微调静默修复识别、CWE 分类与可利用性评级三个下游任务。实验表明 CoLeFunDa 在所有任务上优于当前最优基线；调研验证其实用性；40 个 CVE 中 62.5%（25/40）的 CWE 类别在前 2 推荐中正确。
It is common practice for OSS users to leverage and monitor security advisories to discover newly disclosed OSS vulnerabilities and their corresponding patches for vulnerability remediation. It is common for vulnerability fixes to be publicly available one week earlier than their disclosure. This gap in time provides an opportunity for attackers to exploit the vulnerability. Hence, OSS users need to sense the fix as early as possible so that the vulnerability can be remediated before it is exploited. However, it is common for OSS to adopt a vulnerability disclosure policy which causes the majority of vulnerabilities to be fixed silently, meaning the commit with the fix does not indicate any vulnerability information. In this case even if a fix is identified, it is hard for OSS users to understand the vulnerability and evaluate its potential impact. To improve early sensing of vulnerabilities, the identification of silent fixes and their corresponding explanations (e.g., the corresponding common weakness enumeration (CWE) and exploitability rating) are equally important. However, it is challenging to identify silent fixes and provide explanations due to the limited and diverse data. To tackle this challenge, we propose CoLeFunDa: a framework consisting of a Contrastive Learner and FunDa, which is a novel approach for Function change Data augmentation. FunDa first increases the fix data (i.e., code changes) at the function level with unsupervised and supervised strategies. Then the contrastive learner leverages contrastive learning to effectively train a function change encoder, FCBERT, from diverse fix data. Finally, we leverage FCBERT to further fine-tune three downstream tasks, i.e., silent fix identification, CWE category classification, and exploitability rating classification, respectively. Our result shows that CoLeFunDa outperforms all the state-of-art baselines in all downstream tasks. We also conduct a survey to verify the effectiveness of CoLeFunDa in practical usage. The result shows that CoLeFunDa can categorize 62.5% (25 out of 40) CVEs with correct CWE categories within the top 2 recommendations.
@inproceedings{ZhouPCHXLH23,
title = {CoLeFunDa: Explainable Silent Vulnerability Fix Identification},
author = {Jiayuan Zhou and Michael Pacheco and Jinfu Chen and Xing Hu and Xin Xia and David Lo and Ahmed E. Hassan},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00214}
}