一句话:指出通用深度学习代码评审模型忽视漏洞聚焦评审的特殊性,并强调此类训练数据不足导致性能受限。
代码评审是保障软件质量、缓解潜在问题的重要实践,但人工评审耗时。研究界已尝试用深度学习自动化代码评审,然而现有模型面向广泛的评审类型,往往未考虑与漏洞相关的评审所具有的特殊性。一个原因是漏洞聚焦的评审在训练数据中代表性不足,影响模型准确性。因此,当前对漏洞聚焦代码评审的具体特征以及现有模型在该专门场景下的性能仍缺乏深入了解。摘要未提出具体方法,也未报告评估结果,主要贡献在于识别这一研究空白。
Code review is an important practice in software development, aimed at ensuring code quality and mitigating potential issues. Although effective, manual code reviews are time-consuming. In response, the research community has explored automating this process using deep learning. However, existing models, designed to address a broad spectrum of code review types, often fail to account for the unique aspects of reviews specifically related to vulnerabilities. One reason is the underrepresentation of such reviews in training datasets, which impacts the accuracy of these models. Consequently, there is limited knowledge on the specific characteristics of vulnerability-focused code reviews and the performance of current models in this specialized context.