一句话：构建覆盖40多种语言的漏洞代码与补丁数据集，并附带安全补丁提交信息以支持机器学习检测。
软件漏洞及其代码特征的研究有助于开发更安全的软件。本文提出了 CrossVul，一个约1.4 GB的数据集，包含存在漏洞的源代码文件及其对应的修复版本。与其他漏洞数据集不同，CrossVul覆盖40多种编程语言，每个文件关联一个CVE编号及其来源仓库。此外，作者还提供了一个辅助数据集，包含来自Git提交的安全补丁提交信息。论文通过具体用例表明，该数据集可用于训练机器学习模型来识别缺陷，以及检测安全补丁提交。
Examining the characteristics of software vulnerabilities and the code that contains them can lead to the development of more secure software. We present a dataset (∼1.4 GB) containing vulnerable source code files together with the corresponding, patched versions. Contrary to other existing vulnerability datasets, ours includes vulnerable files written in more than 40 programming languages. Each file is associated to (1) a Common Vulnerability Exposures identifier (CVE ID) and (2) the repository it came from. Further, our dataset can be the basis for machine learning applications that identify defects, as we show in specific examples. We also present a supporting dataset that contains commit messages derived from Git commits that serve as security patches. This dataset can be used to train ML models that in turn, can be used to detect security patch commits as we highlight in a specific use case.
DOI 原文 ·
@inproceedings{paperbot6308,
title = {CrossVul: a cross-language vulnerability dataset with commit data},
author = {Georgios Nikitopoulos and Konstantina Dritsa and Panos Louridas and Dimitris Mitropoulos},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3473122}
}