一句话：提出可解释框架，预测静默易受攻击依赖告警，并生成漏洞类型、根因、攻击向量与影响解释。
开源软件广泛使用，但维护者常静默修复漏洞，使依赖用户无法及时感知威胁。已有工作主要进行黑盒二分类的静默依赖告警检测，误报率高且需用户自行分析解释。本文提出一个结合二分类检测器与编码器-解码器生成模型的框架，用于可解释的静默易受攻击依赖告警预测，生成漏洞类型、根因、攻击向量和影响四类漏洞关键方面，以提升预测可信度与用户接受度。实验比较多种模型和输入，发现 CodeBERT 结合提交信息与代码变更效果最佳；用户研究表明，可解释告警比黑盒预测更能帮助用户发现静默依赖告警。据作者所知，这是将可解释 AI 应用于静默依赖告警预测的首项工作。
Due to convenience, open-source software is widely used. For beneficial reasons, open-source maintainers often fix the vulnerabilities silently, exposing their users unaware of the updates to threats. Previous works all focus on black-box binary detection of the silent dependency alerts that suffer from high false-positive rates. Open-source software users need to analyze and explain AI prediction themselves. Explainable AI becomes remarkable as a complementary of black-box AI models, providing details in various forms to explain AI decisions. Noticing there is still no technique that can discover silent dependency alert on time, in this work, we propose a framework using an encoder-decoder model with a binary detector to provide explainable silent dependency alert prediction. Our model generates 4 types of vulnerability key aspects including vulnerability type, root cause, attack vector, and impact to enhance the trustworthiness and users' acceptance to alert prediction. By experiments with several models and inputs, we confirm CodeBERT with both commit messages and code changes achieves the best results. Our user study shows that explainable alert predictions can help users find silent dependency alert more easily than black-box predictions. To the best of our knowledge, this is the first research work on the application of Explainable AI in silent dependency alert prediction, which opens the door of the related domains.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2302-07445,
title = {Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation},
author = {Jiamou Sun and Zhenchang Xing and Qinghua Lu and Xiwei Xu and Liming Zhu and Thong Hoang and Dehai Zhao},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00089}
}