一句话：提出利用大语言模型从CVE描述中识别漏洞根因所在函数，以支持漏洞可达性分析与复现等下游任务。
开源软件促进了代码复用，但公开漏洞数量激增，给下游用户带来严重安全风险。漏洞可达性分析与漏洞复现等任务的关键是识别漏洞根因所在的易受攻击函数；然而公开漏洞数据集（如NVD）通常不包含该信息，精确定位漏洞函数仍是长期挑战。论文提出基于CVE描述、由大语言模型赋能的有效漏洞函数识别方法。给出的摘要主要阐述问题背景与挑战，未展开具体模型设计、训练或推理流程及实验评估；因此其核心方法细节与关键结果仍需参见论文正文。
Open-source software (OSS) has profoundly transformed the software development paradigm by facilitating effortless code reuse. However, in recent years, there has been an alarming increase in disclosed vulnerabilities within OSS, posing significant security risks to downstream users. Therefore, analyzing existing vulnerabilities and precisely assessing their threats to downstream applications become pivotal. Plenty of efforts have been made recently towards this problem, such as vulnerability reachability analysis and vulnerability reproduction. The key to these tasks is identifying the vulnerable function (i.e., the function where the root cause of a vulnerability resides). However, public vulnerability datasets (e.g., NVD) rarely include this information as pinpointing the exact vulnerable functions remains to be a longstanding challenge.
DOI 原文 ·
@inproceedings{paperbot8280,
title = {Effective Vulnerable Function Identification based on CVE Description Empowered by Large Language Models},
author = {Yulun Wu and Ming Wen and Zeliang Yu and Xiaochen Guo and Hai Jin},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695013}
}