一句话：提出 MemVul，利用带记忆增强的神经网络从公开 issue 报告自动识别泄露漏洞信息的危险报告。
开源软件漏洞管理通常遵循协调漏洞披露流程，但许多漏洞会先通过公开 issue 报告泄露，形成危险报告，可能被攻击者用于零日攻击。本文提出 MemVul，在神经网络中加入记忆组件，存储 Common Weakness Enumeration (CWE) 的外部漏洞知识，并用 CVE-referred IRs (CIRs) 操作化危险报告概念。作者从 GitHub 1,390 个开源项目挖掘 3,937 个 CIRs，在高数据不平衡场景下评估；MemVul 的 F1 为 0.49，较最佳基线提升 44%。对预测为 CIR 但未报 CVE 的报告进行用户研究，82%（41/50）与安全相关，其中 28 个被安全专家建议公开披露。
The coordinated vulnerability disclosure (CVD) process is commonly adopted for open source software (OSS) vulnerability management, which suggests to privately report the discovered vulnerabilities and keep relevant information secret until the official disclosure. However, in practice, due to various reasons (e.g., lacking security domain expertise or the sense of security management), many vulnerabilities are first reported via public issue reports (IRs) before its official disclosure. Such IRs are dangerous IRs, since attackers can take advantages of the leaked vulnerability information to launch zero-day attacks. It is crucial to identify such dangerous IRs at an early stage, such that OSS users can start the vulnerability remediation process earlier and OSS maintainers can timely manage the dangerous IRs. In this paper, we propose and evaluate a deep learning based approach, namely MemVul, to automatically identify dangerous IRs at the time they are reported. MemVul augments the neural networks with a memory component, which stores the external vulnerability knowledge from Common Weakness Enumeration (CWE). We rely on publicly accessible CVE-referred IRs (CIRs) to operationalize the concept of dangerous IR. We mine 3,937 CIRs distributed across 1,390 OSS projects hosted on GitHub. Evaluated under a practical scenario of high data imbalance, MemVul achieves the best trade-off between precision and recall among all baselines. In particular, the F1-score of MemVul (i.e., 0.49) improves the best performing baseline by 44%. For IRs that are predicted as CIRs but not reported to CVE, we conduct a user study to investigate their usefulness to OSS stakeholders. We observe that 82% (41 out of 50) of these IRs are security-related and 28 of them are suggested by security experts to be publicly disclosed, indicating MemVul is capable of identifying undisclosed dangerous IRs.
DOI 原文 ·
@inproceedings{paperbot6969,
title = {Automated unearthing of dangerous issue reports},
author = {Shengyi Pan and Jiayuan Zhou and Filipe Roseiro Cogo and Xin Xia and Lingfeng Bao and Xing Hu and Shanping Li and Ahmed E. Hassan},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549156}
}