一句话：提出 VulAdvisor，用 ChatGPT 抽取 oracle 构建数据集并微调 CodeT5，为漏洞修复生成自然语言建议。
现有深度学习自动漏洞修复（AVR）方法通常直接生成补丁，与开发者的实际修复实践和期望不符。本文提出 VulAdvisor，自动生成自然语言修复建议以指导开发者或 AVR 工具。它包含 oracle 抽取与建议学习两部分：为缓解历史数据不足，提出 oracle 抽取方法借助 ChatGPT 构建全面高质量数据集；建议学习以监督微调的 CodeT5 为基础，将局部上下文融入多头注意力并引入修复动作损失，以提升建议的相关性与意义。在真实 C/C++ 项目的大规模数据集上，VulAdvisor 在词法与语义指标上均超越多个对比方法；生成的建议还能增强现有 AVR 工具的补丁生成能力，人工评估亦验证了其建议的质量与实用性。
Software vulnerabilities pose serious threats to the security of modern software systems. Deep Learning-based Automated Vulnerability Repair (AVR) has gained attention as a potential solution to accelerate the remediation of vulnerabilities. However, recent studies indicate that existing AVR approaches often only generate patches, which may not align with developers' current repair practices or expectations. In this paper, we introduce VulAdvisor, an automated approach that generates natural language suggestions to guide developers or AVR tools in repairing vulnerabilities. VulAdvisor comprises two main components: oracle extraction and suggestion learning. To address the challenge of limited historical data, we propose an oracle extraction method facilitating ChatGPT to construct a comprehensive and high-quality dataset. For suggestion learning, we take the supervised fine-tuning CodeT5 model as the basis, integrating local context into Multi-Head Attention and introducing a repair action loss, to improve the relevance and meaningfulness of the generated suggestions. Extensive experiments on a large-scale dataset from real-world C/C++ projects demonstrate the effectiveness of VulAdvisor, surpassing several alternatives in terms of both lexical and semantic metrics. Moreover, we show that the generated suggestions enhance the patch generation capabilities of existing AVR tools. Human evaluations further validate the quality and utility of VulAdvisor's suggestions, confirming their potential to improve software vulnerability repair practices.
@inproceedings{paperbot8422,
title = {VulAdvisor: Natural Language Suggestion Generation for Software Vulnerability Repair},
author = {Jian Zhang and Chong Wang and Anran Li and Wenhan Wang and Tianlin Li and Yang Liu},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695555}
}