一句话：提出 RepoSPD，通过仓库级代码图与结构感知表示学习提升安全补丁检测。
安全补丁常缺少充分公告，检测其对软件安全维护至关重要。现有方法主要关注补丁自身信息，忽视仓库级依赖，且安全补丁常跨多个函数与文件，表示学习困难。本文提出仓库级安全补丁检测框架 RepoSPD：构建仓库级图 RepoCPG，合并补丁前后源码；设计结构感知补丁表示，融合图与序列分支；采用渐进学习平衡语义与结构信息。作者将 SPI-DB 与 PatchDB 扩展为仓库级数据集 SPI-DB* 和 PatchDB*，并与六种检测方法及五种静态工具比较。结果表明，RepoSPD 在两个数据集上准确率分别提升 11.90% 和 3.10%，且能多检测 151 个安全补丁，较最佳基线提升 21.36%。
Software vendors often silently release security patches without providing sufficient advisories (e.g., Common Vulnerabilities and Exposures) or delayed updates via resources (e.g., National Vulnerability Database). Therefore, it has become crucial to detect these security patches to ensure secure software maintenance. However, existing methods face the following challenges: (1) They primarily focus on the information within the patches themselves, overlooking the complex dependencies in the repository. (2) Security patches typically involve multiple functions and files, increasing the difficulty in well learning the representations. To alleviate the above challenges, this paper proposes a Repository-level Security Patch Detection framework named RepoSPD, which comprises three key components: 1) a repository-level graph construction, RepoCPG, which represents software patches by merging pre-patch and post-patch source code at the repository level; 2) a structure-aware patch representation, which fuses the graph and sequence branch and aims at comprehending the relationship among multiple code changes; 3) progressive learning, which facilitates the model in balancing semantic and structural information. To evaluate RepoSPD, we employ two widely-used datasets in security patch detection: SPI-DB and PatchDB. We further extend these datasets to the repository level, incorporating a total of 20,238 and$\mathbf{2 8, 7 8 1}$versions of repository in C/C++ programming languages, respectively, denoted as SPI-DB* and PatchDB*. We compare RepoSPD with six existing security patch detection methods and five static tools. Our experimental results demonstrate that RepoSPD outperforms the state-of-the-art baseline, with improvements of 11.90 %, and 3.10 % in terms of accuracy on the two datasets, respectively. These results underscore the effectiveness of RepoSPD in detecting security patches. Furthermore, RepoSPD can detect 151 security patches, which outperforms the best-performing baseline by$\mathbf{2 1. 3 6 \%}$with respect to accuracy.
DOI 原文 ·
@inproceedings{paperbot8862,
title = {Repository-Level Graph Representation Learning for Enhanced Security Patch Detection},
author = {Xin-Cheng Wen and Zirui Lin and Cuiyun Gao and Hongyu Zhang and Yong Wang and Qing Liao},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00121}
}