一句话：VulMaster 综合完整漏洞代码、结构信息与 CWE 专家知识，显著提升自动漏洞修复效果。
基于深度学习的自动漏洞修复方法通常学习从漏洞代码到修复代码的映射，但现有方法存在三个局限：难以处理长漏洞代码、把代码当作自然语言而忽略其结构、未利用专家系统中的专家知识。为此，作者提出 VulMaster，一个基于 Transformer 的神经网络模型，能够不受长度限制地理解完整漏洞代码，并融合漏洞代码结构与来自 CWE 系统的专家知识来生成修复。作者在包含 1,754 个项目、5,800 个漏洞函数的真实 C/C++ 漏洞修复数据集上进行评估。结果表明，VulMaster 相比最先进的基于学习的漏洞修复方法有显著提升：EM 从 10.2% 提升至 20.0%，BLEU 从 21.3% 提升至 29.3%，CodeBLEU 从 32.5% 提升至 40.9%。
The advances of deep learning (DL) have paved the way for automatic software vulnerability repair approaches, which effectively learn the mapping from the vulnerable code to the fixed code. Nevertheless, existing DL-based vulnerability repair methods face notable limitations: 1) they struggle to handle lengthy vulnerable code, 2) they treat code as natural language texts, neglecting its inherent structure, and 3) they do not tap into the valuable expert knowledge present in the expert system. To address this, we propose VulMaster, a Transformer-based neural network model that excels at generating vulnerability repairs by comprehensively understanding the entire vulnerable code, irrespective of its length. This model also integrates diverse information, encompassing vulnerable code structures and expert knowledge from the CWE system. We evaluated VulMaster on a real-world C/C++ vulnerability repair dataset comprising 1,754 projects with 5,800 vulnerable functions. The experimental results demonstrated that VulMaster exhibits substantial improvements compared to the learning-based state-of-the-art vulnerability repair approach. Specifically, VulMaster improves the EM, BLEU, and CodeBLEU scores from 10.2% to 20.0%, 21.3% to 29.3%, and 32.5% to 40.9%, respectively.
@inproceedings{paperbot11288,
title = {Out of Sight, Out of Mind: Better Automatic Vulnerability Repair by Broadening Input Ranges and Sources},
author = {Xin Zhou and Kisub Kim and Bowen Xu and Donggyun Han and David Lo},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639222}
}