一句话：提出基于 Transformer 的 VulFixMiner，从提交级代码变更中自动识别静默漏洞修复。
开源软件常按协调漏洞披露模型静默修复漏洞，导致修复提交到公开仓库后到正式披露之间可能延迟数天至数年，用户难以及时感知。人工分析所有代码变更以发现漏洞修复不可行。本文提出 VulFixMiner，一种基于 Transformer 的方法，从提交级代码变更中自动提取语义信息来识别静默漏洞修复。模型使用来自 204 个项目的采样提交构建，并在另外 52 个项目的全部提交上评估。结果表明，VulFixMiner 在 Java 和 Python 数据集上的 AUC 分别达 0.81 和 0.73，优于多种当前最优基线，并在 EffortCost、Popt 等代价感知指标上表现良好；检查 5% 代码行即可识别 49% 的漏洞修复。人工验证还发现，数据集中未标记但被模型识别为漏洞修复的提交中有 35%（29/82）确为漏洞修复，说明其能发现未报告的漏洞修复。
Following the coordinated vulnerability disclosure model, a vulnerability in open source software (OSS) is sug-gested to be fixed "silently", without disclosing the fix until the vulnerability is disclosed. Yet, it is crucial for OSS users to be aware of vulnerability fixes as early as possible, as once a vulnerability fix is pushed to the source code repository, a malicious party could probe for the corresponding vulnerability to exploit it. In practice, OSS users often rely on the vulnerability disclosure information from security advisories (e.g., National Vulnerability Database) to sense vulnerability fixes. However, the time between the availability of a vulnerability fix and its disclosure can vary from days to months, and in some cases, even years. Due to manpower constraints and the lack of expert knowledge, it is infeasible for OSS users to manually analyze all code changes for vulnerability fix detection. Therefore, it is essential to identify vulnerability fixes automatically and promptly. In a first-of-its-kind study, we propose VulFixMiner, a Transformer-based approach, capable of automatically extracting semantic meaning from commit-level code changes to identify silent vulnerability fixes. We construct our model using sampled commits from 204 projects, and evaluate using the full set of commits from 52 additional projects. The evaluation results show that VulFixMiner outperforms various state-of-the-art baselines in terms of AUC (i.e., 0.81 and 0.73 on Java and Python dataset, respectively) and two effort-aware performance metrics (i.e., EffortCost, Popt). Especially, with an effort of inspecting 5% of total LOC, VulFixMiner can identify 49% of total vulnerability fixes. Additionally, with manual verification of sampled commits that were identified as vulnerability fixes, but not marked as such in our dataset, we observe that 35% (29 out of 82) of the commits are for fixing vulnerabilities, indicating VulFixMiner is also capable of identifying unreported vulnerability fixes.
DOI 原文 ·
@inproceedings{paperbot6498,
title = {Finding A Needle in a Haystack: Automated Mining of Silent Vulnerability Fixes},
author = {Jiayuan Zhou and Michael Pacheco and Zhiyuan Wan and Xin Xia and David Lo and Yuan Wang and Ahmed E. Hassan},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678720}
}