一句话：提出 Maestro 平台，通过 RESTful API 连接漏洞基准与 APR 工具，实现可复现、公平的自动漏洞修复实验。
自动修复软件漏洞是软件安全的新兴方向，已有工作尝试用自动程序修复（APR）完成该任务，但缺少可复现的修复流水线和公平比较平台。本文提出 Maestro：一个去中心化、模块化的平台，通过 RESTful API 和插件机制连接漏洞基准与 APR 工具，支持受控实验，并提供 C 与 Java 的初步工具和数据集。作者在十个项目上用四种 APR 工具进行实验，与先前研究比较执行时间，发现 C 项目约有 23 秒开销，Java 项目减少约 14 秒。Maestro 可作为工具无关的漏洞修复实验平台，并能通过专用插件扩展工具、基准与修复工作流。
Automating the repair of vulnerabilities is emerging in the field of software security. Previous efforts have leveraged Automated Program Repair (APR) for the task. Reproducible pipelines of repair tools on vulnerability benchmarks can promote advances in the field, such as new repair techniques. We propose Maestro, a decentralized platform with RESTful APIs for performing automated software vulnerability repair. Our platform connects benchmarks of vulnerabilities with APR tools for performing controlled experiments. It also promotes fair comparisons among different APR tools. We compare the performance of Maestro with previous studies on four APR tools in finding repairs for ten projects. Our execution time results indicate an overhead of 23 seconds for projects in C and a reduction of 14 seconds for Java projects. We introduce an agnostic platform for vulnerability repair with preliminary tools/datasets for both C and Java. Maestro is modular and can accommodate tools, benchmarks, and repair workflows with dedicated plugins.
@inproceedings{paperbot7381,
title = {Maestro: a platform for benchmarking automatic program repair tools on software vulnerabilities},
author = {Eduard Pinconschi and Quang-Cuong Bui and Rui Abreu and Pedro Adão and Riccardo Scandariato},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3543291}
}