一句话：提出 SHIP，用 LLM 建模提交与漏洞及提交间关联，解决多补丁场景的静默漏洞补丁识别。
漏洞披露后，维护者常静默提交修复补丁，导致下游维护者难以从海量代码提交中识别对应补丁，即静默漏洞补丁识别（SVPI）。现有 SVPI 技术多假设一个漏洞只对应一个补丁，输出单补丁与漏洞的相似度排序，忽略了一个漏洞可能对应多个补丁及其关联。本文提出 SHIP：先用启发式特征召回高相关代码提交，再用大语言模型 DeepSeek-V3 预测漏洞-提交链接及提交-提交链接，生成包含一个或多个提交的候选补丁组；最后对组内特征做 max-pooling 排序，输出 Top-1 组。在 4,631 个漏洞项基准上，Recall、Precision、F1 分别达 84.30%、59.14%、69.51%，较 SOTA 分别提升 37.54%、28.71%、32.35%。
For a vulnerability reported as an item of platforms such as CVE or NVD, software maintainers need to submit patches (in the form of code commit) to fix it, which is often performed silently for the sake of keeping products’ reputation or avoiding malicious attacks. But such a silent practice keeps patches hidden from affected downstream software maintainers, thus they have to identify patches in a large corpus of code commits manually, i.e., silent vulnerability patch identification (SVPI). Existing techniques in this field were often developed under the assumption that a vulnerability is matched to one patch, thus output a ranking list that simply reflects the similarity between one individual patch and the vulnerability. However, previous research has demonstrated that many vulnerabilities correspond to more than one patch in practice, this phenomenon largely threatens the effectiveness of existing SVPI techniques because they typically ignore the correlation between patches. In this paper, we propose SHIP, a Silent vulnerability patcH Identification approach suited for multiPle-patch scenarios, to make patches corresponding to a vulnerability no longer isolated islands. For a vulnerability item, we first obtain several highly-relevant code commits by measuring heuristic features, and then employ a large language model (i.e., DeepSeek-V3) to predict both the link between a code commit and the vulnerability as well as the link between a pair of code commits, and thus deliver candidate groups each containing one or more code commits that could be patches of the vulnerability. Finally, we perform the max-pooling strategy on the features of code commit(s) contained in each candidate group to determine the ranking of groups, the Top-1 group will be output. The experimental results demonstrate the promise of SHIP: on the benchmark consisting of 4,631 vulnerability items, it can achieve 84.30%, 59.14%, and 69.51% of Recall, Precision, and F1-Score, respectively, outperforming the state-of-the-art SVPI technique by 37.54%, 28.71%, and 32.35%, respectively.
DOI 原文 ·
@inproceedings{paperbot9237,
title = {Not Every Patch is an Island: LLM-Enhanced Identification of Multiple Vulnerability Patches},
author = {Yi Song and Dongchen Xie and Lin Xu and He Zhang and Chunying Zhou and Xiaoyuan Xie},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00087}
}