论文标题
沃尔希尔：脆弱性固定提交检测器
VulCurator: A Vulnerability-Fixing Commit Detector
论文作者
论文摘要
如今，随着发现的OSS漏洞的数量，开源软件（OSS）漏洞管理流程随着时间的流逝而变得重要。监视漏洞解决方案是防止脆弱性开发的标准过程的一部分。但是，由于可能有大量的审查，手动检测漏洞固定的犯罪是耗时的。最近，已经提出了许多技术，可以自动检测使用机器学习的漏洞固定提交。这些解决方案要么：（1）不使用深度学习，或者（2）仅对有限的信息来源使用深度学习。本文提出了藤武器，该工具利用了更丰富的信息来源，包括提交消息，代码更改和发行漏洞 - 固定性提交分类的报告。我们的实验结果表明，在F1得分方面，沃尔希尔的表现优于最先进的基线。 Vulcurator工具可在https://github.com/ntgiang71096/vfdetector和https://zenodo.org/record/7034132#.yw3mn-xbzdi上公开获得。
Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, including commit messages, code changes and issue reports for vulnerability-fixing commit classifica- tion. Our experimental results show that VulCurator outperforms the state-of-the-art baselines up to 16.1% in terms of F1-score. VulCurator tool is publicly available at https://github.com/ntgiang71096/VFDetector and https://zenodo.org/record/7034132#.Yw3MN-xBzDI, with a demo video at https://youtu.be/uMlFmWSJYOE.
