论文标题
Puminer：开发人员问答的采矿安全帖子，并通过PU学习回答网站
PUMiner: Mining Security Posts from Developer Question and Answer Websites with PU Learning
论文作者
论文摘要
安全是软件开发的越来越多的关注点。开发人员问答（问答）网站提供了大量的安全性讨论。现有的研究已使用人类定义的规则来挖掘安全性讨论，但是这些作品仍然错过了许多帖子，这可能会导致对问答网站上报告的安全实践的不完整分析。传统的监督机器学习方法可以自动化采矿过程；但是，所需的负（非安全）类太贵了。我们建议一个新颖的学习框架Puminer，以自动从问答网站开采安全帖子。 Puminer构建了一个上下文感知的嵌入模型，以提取帖子的功能，然后开发一个两阶段的PU模型，以使用标记为正面和未标记的帖子来识别安全内容。我们评估了Puminer在堆栈溢出方面超过1720万张帖子和Security Stackexchange上的52,611个帖子。我们表明，Puminer在所有模型配置中的验证性能至少为0.85都是有效的。此外，Puminer的Matthews相关系数（MCC）为0.906、0.534和0.084点，比一级SVM高，正相似性滤波和一阶段的PU模型分别在看不见的测试柱上。 Puminer在符合弦完全失败的情况下的MCC还表现良好。即使标记的正帖子与未标记的帖子的比率仅为1：100，Puminer仍然达到了0.65的强大MCC，比完全监督的学习要好160％。使用Puminer，我们为从业人员和研究人员提供问答网站上的最大和最新的安全内容。
Security is an increasing concern in software development. Developer Question and Answer (Q&A) websites provide a large amount of security discussion. Existing studies have used human-defined rules to mine security discussions, but these works still miss many posts, which may lead to an incomplete analysis of the security practices reported on Q&A websites. Traditional supervised Machine Learning methods can automate the mining process; however, the required negative (non-security) class is too expensive to obtain. We propose a novel learning framework, PUMiner, to automatically mine security posts from Q&A websites. PUMiner builds a context-aware embedding model to extract features of the posts, and then develops a two-stage PU model to identify security content using the labelled Positive and Unlabelled posts. We evaluate PUMiner on more than 17.2 million posts on Stack Overflow and 52,611 posts on Security StackExchange. We show that PUMiner is effective with the validation performance of at least 0.85 across all model configurations. Moreover, Matthews Correlation Coefficient (MCC) of PUMiner is 0.906, 0.534 and 0.084 points higher than one-class SVM, positive-similarity filtering, and one-stage PU models on unseen testing posts, respectively. PUMiner also performs well with an MCC of 0.745 for scenarios where string matching totally fails. Even when the ratio of the labelled positive posts to the unlabelled ones is only 1:100, PUMiner still achieves a strong MCC of 0.65, which is 160% better than fully-supervised learning. Using PUMiner, we provide the largest and up-to-date security content on Q&A websites for practitioners and researchers.
