一句话：首次探索从 IoT 项目 issue 报告中检测漏洞指示问题，结合 ML、LLM 与 NLP 并微调 BERT。
该论文关注物联网（IoT）软件中及时识别反映漏洞的 issue 报告这一问题。由于 IoT 系统分析通常慢于非 IoT 系统，作者首次将非 IoT 场景中的 ML/LLM 漏洞指示 issue 检测方法拓展到 IoT。方法包括两类：一是结合机器学习、大语言模型与自然语言处理技术，对 21 个 Eclipse IoT 项目的 issue 报告进行检测；二是在 11,000 条 GitHub issue 上微调预训练 BERT 掩码语言模型以分类漏洞指示 issue。评估显示，基于 BERT NLP 特征训练的 SVM 表现最佳，AUC 为 0.65；微调 BERT 仅达到 0.26 准确率，说明训练时暴露全部数据的重要性。该工作为从 issue 报告准确检测 IoT 漏洞奠定了基础。
Timely identification of issue reports reflecting software vulnerabilities is crucial, particularly for Internet-of-Things (IoT) where analysis is slower than non-IoT systems. While Machine Learning (ML) and Large Language Models (LLMs) detect vulnerability-indicating issues in non-IoT systems, their IoT use remains unexplored. We are the first to tackle this problem by proposing two approaches: (1) combining ML and LLMs with Natural Language Processing (NLP) techniques to detect vulnerability-indicating issues of 21 Eclipse IoT projects and (2) fine-tuning a pre-trained BERT Masked Language Model (MLM) on 11,000 GitHub issues for classifying vulnerability-indicating issues. Our best performance belongs to a Support Vector Machine (SVM) trained on BERT NLP features, achieving an Area Under the receiver operator characteristic Curve (AUC) of 0.65. The fine-tuned BERT achieves 0.26 accuracy, emphasizing the importance of exposing all data during training. Our contributions set the stage for accurately detecting IoT vulnerabilities from issue reports, similar to non-IoT systems.
DOI 原文 ·
@inproceedings{paperbot9475,
title = {Detecting Vulnerabilities from Issue Reports for Internet-of-Things},
author = {Sogol Masoumzadeh},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00394}
}