An Incremental Lightweight Method for Vulnerability Data Collection for Security Patches

Abstract

Automated Program Repair enhances developers’ efficiency by reducing the time dedicated to debugging and fixing source code vulnerabilities. However, the existing datasets utilized to train patch generation models suffer from various limitations, notably the limited bug context, limited size, and reliance on synthetic and unrealistic source code samples. Additionally, existing dataset extraction tools lack an incremental approach, rendering the inclusion of new data a resource-intensive endeavor in terms of both time and computational resources. In this paper, we introduce FixMe , a novel framework designed for generating patches across diverse programming languages. This open-source tool facilitates an incremental approach to gathering vulnerability records from the Common Vulnerabilities and Exposures (CVE) database. Incorporating an incremental methodology accelerates the data acquisition process, encompassing newly identified vulnerabilities and their corresponding patch pairs. Our dataset curation method involves the extraction of security issues, acquiring vulnerability-fixing commits, and extracting source code from relevant projects. The resultant dataset comprises 18,063 CVEs from 2,133 commits, encompassing 19,109 patch sets with 44,059 vulnerability-fix pairs (patch hunks). This dataset spans 884 open-source projects hosted in git-based systems. Additionally , the study explores fostering the potential of APR techniques in reducing debugging costs and improving software quality by generating patches for fixing vulnerabilities automatically.