一句话：提出与语言无关的 FVF 框架，利用代码变更历史识别并过滤相似但已修补代码，显著减少重复漏洞检测误报。
重复漏洞检测对软件安全至关重要，但基于克隆的技术常因相似但已修补（SBP）代码产生大量误报。现有方法多依赖函数签名，未充分探索 SBP。本文提出编程语言无关的 Fixed Vulnerability Filter（FVF）框架，通过分析代码变更历史精准识别并过滤 SBP，以降低误报。评估中，FVF 从 ReDeBug、VUDDY、MVP 和基础哈希方法四个漏洞检测工具过滤掉 65.1% 的误报且无假阳性。作者还将其用于 1,081 个真实项目，构建含 6,827 个 SBP 函数的数据集，并用其揭示四种先进深度学习漏洞检测方法的不足。该数据集可作为严格基准，支持更真实地评估漏洞检测方法并推动 SBP 研究。
Identifying recurring vulnerabilities is crucial for ensuring software security. Clone-based techniques, while widely used, often generate many false alarms due to the existence of similar but patched (SBP) code, which is similar to vulnerable code but is not vulnerable due to having been patched. Although the SBP code poses a great challenge to the effectiveness of existing approaches, it has not yet been well explored. In this paper, we propose a programming language agnostic framework, Fixed Vulnerability Filter (FVF), to identify and filter such SBP instances in vulnerability detection. Different from existing studies that leverage function signatures, our approach analyzes code change histories to precisely pinpoint SBPs and consequently reduce false alarms. Evaluation under practical scenarios confirms the effectiveness and precision of our approach. Remarkably, FVF identifies and filters 65.1 % of false alarms from four vulnerability detection tools (i.e., ReDeBug, VUDDY, MVP, and an elementary hash-based approach) without yielding false positives. We further apply FVF to 1,081 real-world software projects and construct a real-world SBP dataset containing 6,827 SBP functions. Due to the SBP nature, the dataset can act as a strict benchmark to test the sensitivity of the vulnerability detection approach in distinguishing real vulnerabilities and SBPs. Using this dataset, we demonstrate the ineffectiveness of four state-of-the-art deep learning-based vulnerability detection approaches. Our dataset can help developers make a more realistic evaluation of vulnerability detection approaches and also paves the way for further exploration of real-world SBP scenarios.
DOI 原文 ·
@inproceedings{paperbot8689,
title = {Similar but Patched Code Considered Harmful: The Impact of Similar but Patched Code on Recurring Vulnerability Detection and How to Remove Them},
author = {Zixuan Tan and Jiayuan Zhou and Xing Hu and Shengyi Pan and Kui Liu and Xin Xia},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00110}
}