一句话：提出 TreeVul，利用 CWE 树结构对安全补丁提交进行细粒度漏洞类型分层多标签分类。
现有安全补丁检测方法多只判断提交是否含补丁（二分类），无法定位漏洞类型。本文首次将安全补丁分类到细粒度漏洞类型，以 CWE 第三层为标签，形式化为分层多标签分类（HMC）：推断从 CWE 树根到目标深度节点的路径。作者提出 TreeVul，采用分层链式架构，将 CWE 树结构作为先验知识，并用树结构感知的 beam search 推断最高合并概率路径。从 NVD 收集 6,541 个提交、覆盖 1,560 个 GitHub OSS 仓库。实验表明 TreeVul 优于最佳基线，weighted F1、macro F1、MCC 分别提升 5.9%、25.0%、7.7%；用户研究与案例研究验证其实际价值。
Identifying security patches via code commits to allow early warnings and timely fixes for Open Source Software (OSS) has received increasing attention. However, the existing detection methods can only identify the presence of a patch (i.e., a binary classification) but fail to pinpoint the vulnerability type. In this work, we take the first step to categorize the security patches into fine-grained vulnerability types. Specifically, we use the Common Weakness Enumeration (CWE) as the label and perform fine-grained classification using categories at the third level of the CWE tree. We first formulate the task as a Hierarchical Multi-label Classification (HMC) problem, i.e., inferring a path (a sequence of CWE nodes) from the root of the CWE tree to the node at the target depth. We then propose an approach named TreeVul with a hierarchical and chained architecture, which manages to utilize the structure information of the CWE tree as prior knowledge of the classification task. We further propose a tree structure aware and beam search based inference algorithm for retrieving the optimal path with the highest merged probability. We collect a large security patch dataset from NVD, consisting of 6,541 commits from 1,560 GitHub OSS repositories. Experimental results show that Tree-vulsignificantly outperforms the best performing baselines, with improvements of 5.9%, 25.0%, and 7.7% in terms of weighted F1-score, macro F1-score, and MCC, respectively. We further conduct a user study and a case study to verify the practical value of TreeVul in enriching the binary patch detection results and improving the data quality of NVD, respectively.
@inproceedings{PanBXLL23,
title = {Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure},
author = {Shengyi Pan and Lingfeng Bao and Xin Xia and David Lo and Shanping Li},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00088}
}