一句话：提出 VulCurator，利用提交信息、代码变更和 issue 报告的深度学习来分类漏洞修复提交。
开源软件漏洞数量持续增长，监控漏洞修复提交对防止漏洞利用至关重要，但人工审查大量提交非常耗时。现有基于机器学习的自动检测方法要么未使用深度学习，要么仅利用有限信息源。本文提出 VulCurator，在提交信息、代码变更和 issue 报告等更丰富信息上使用深度学习，对漏洞修复提交进行分类。实验结果显示，VulCurator 在 F1 分数上比当前最优基线最高提升 16.1%。
Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time-consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, including commit messages, code changes and issue reports for vulnerability-fixing commit classification. Our experimental results show that VulCurator outperforms the state-of-the-art baselines up to 16.1% in terms of F1-score.
DOI 原文 ·
@inproceedings{paperbot7133,
title = {VulCurator: a vulnerability-fixing commit detector},
author = {Truong Giang Nguyen and Thanh Le-Cong and Hong Jin Kang and Xuan-Bach D. Le and David Lo},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3558936}
}