一句话：提出首个从漏洞报告追踪漏洞相关文件的框架，结合 LLM、搜索与分类器推荐文件并提升 SBOM 细粒度。
开源软件广泛使用使供应链漏洞攻击（如 SolarWinds、Log4Shell）风险加剧，但现有漏洞公告库和商业 SBOM 通常不提供文件级漏洞信息，主流漏洞检测方法也难以弥补这一缺口。本文提出一个从已披露漏洞报告中追踪漏洞相关文件的框架：以 NVD 描述及元数据为输入，结合 LLM、搜索引擎、启发式文本匹配和深度学习分类器，为每个漏洞推荐最可能相关的文件。实验验证了框架效率，CodeBERT 达到 0.92 AUC 和 0.85 MAP；用户研究也表明该方法能有效辅助漏洞相关文件检测。据作者所知，这是首个聚焦漏洞相关文件追踪的工作，为构建更细粒度的漏洞感知 SBOM 奠定基础。
With the widely usage of open-source software, supply-chain-based vulnerability attacks, including SolarWind and Log4Shell, have posed significant risks to software security. Currently, people rely on vulnerability advisory databases or commercial software bill of materials (SBOM) to defend against potential risks. Unfortunately, these datasets do not provide finer-grained file-level vulnerability information, compromising their effectiveness. Previous works have not adequately addressed this issue, and mainstream vulnerability detection methods have their drawbacks that hinder resolving this gap. Driven by the real needs, we propose a framework that can trace the vulnerability-relevant file for each disclosed vulnerability. Our approach uses NVD descriptions with metadata as the inputs, and employs a series of strategies with a LLM model, search engine, heuristic-based text matching method and a deep learning classifier to recommend the most likely vulnerability-relevant file, effectively enhancing the completeness of existing NVD data. Our experiments confirm that the efficiency of the proposed framework, with CodeBERT achieving 0.92 AUC and 0.85 MAP, and our user study proves our approach can help with vulnerability-relevant file detection effectively. To the best of our knowledge, our work is the first one focusing on tracing vulnerability-relevant files, laying the groundwork of building finer-grained vulnerability-aware software bill of materials.
@inproceedings{paperbot11479,
title = {Where is it? Tracing the Vulnerability-relevant Files from Vulnerability Reports},
author = {Jiamou Sun and Jieshan Chen and Zhenchang Xing and Qinghua Lu and Xiwei Xu and Liming Zhu},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639202}
}