一句话：提出 PatchFinder 两阶段框架，结合混合检索与端到端重排序，自动追踪 CVE 披露漏洞的安全补丁提交。
开源软件漏洞日益普遍，但 NVD 等平台的大量 CVE 记录仍缺少指向安全补丁的追踪链接。现有基于排序的方法多依赖手工特征和单步框架，效果受限。本文提出 PatchFinder：检索阶段用混合补丁检索器，基于 CVE 描述与代码变更同时进行词汇和语义匹配，从提交中召回候选并缩小搜索空间；重排序阶段在监督微调范式下设计端到端架构，学习 CVE 描述与提交间的语义相关性，自动打分排序并保持较低计算开销。在 532 个开源项目的 4,789 个 CVE 上评估，Recall@10 达 80.63%，MRR 为 0.7951，Manual Effort@10 降至 2.77，较当前领先方法提升 1.94 倍；实践中发现 533 个补丁提交，其中 482 个获 CVE 编号机构确认。
Open-source software (OSS) vulnerabilities are increasingly prevalent, emphasizing the importance of security patches. However, in widely used security platforms like NVD, a substantial number of CVE records still lack trace links to patches. Although rank-based approaches have been proposed for security patch tracing, they heavily rely on handcrafted features in a single-step framework, which limits their effectiveness. In this paper, we propose PatchFinder, a two-phase framework with end-to-end correlation learning for better-tracing security patches. In the initial retrieval phase, we employ a hybrid patch retriever to account for both lexical and semantic matching based on the code changes and the description of a CVE, to narrow down the search space by extracting those commits as candidates that are similar to the CVE descriptions. Afterwards, in the re-ranking phase, we design an end-to-end architecture under the supervised fine-tuning paradigm for learning the semantic correlations between CVE descriptions and commits. In this way, we can automatically rank the candidates based on their correlation scores while maintaining low computation overhead. We evaluated our system against 4,789 CVEs from 532 OSS projects. The results are highly promising: PatchFinder achieves a Recall@10 of 80.63% and a Mean Reciprocal Rank (MRR) of 0.7951. Moreover, the Manual Effort@10 required is curtailed to 2.77, marking a 1.94 times improvement over current leading methods. When applying PatchFinder in practice, we initially identified 533 patch commits and submitted them to the official, 482 of which have been confirmed by CVE Numbering Authorities.
@inproceedings{paperbot8542,
title = {PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software},
author = {Kaixuan Li and Jian Zhang and Sen Chen and Han Liu and Yang Liu and Yixiang Chen},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680305}
}