Can an old fashioned feature extraction and a light-weight model improve vulnerability type identification performance?

Vo, Hieu Dinh; Nguyen, Son

doi:10.1016/j.infsof.2023.107304

Cited by 4 publications

(1 citation statement)

References 53 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several studies have been proposed for specific software engineering tasks, including code suggestion/completion [31][32][33], code summarization [34][35][36], program synthesis [37], pull request description generation [38,39], code clones [40], fuzz testing [41], code-text translation [42], and bug/vulnerability detection [14,43,44].…”

Section: Related Workmentioning

confidence: 99%

Silent Vulnerability-fixing Commit Identification Based on Graph Neural Networks

Vo,

Vu,

Nguyen

2024

JCSCE

View full text Add to dashboard Cite

In this paper, we present VFFinder, a novel graph-based approach for automated silentvulnerability fix identification. To precisely capture the meaning of code changes, the changed code isrepresented in connection with the related unchanged code. In VFFinder, the structure of the changedcode and related unchanged code are captured and the structural changes are represented in annotatedAbstract Syntax Trees (αAST). VFFinder distinguishes vulnerability-fixing commits from non-fixingones using attention-based graph neural network models to extract structural features expressed inαASTs. We conducted experiments to evaluate VFFinder on a dataset of 11K+ vulnerability fixingcommits in 507 real-world C/C++ projects. Our results show that VFFinder significantly improvesthe state-of-the-art methods by 272–420% in Precision, 22–70% in Recall, and 3.2X–8.2X in F1.Especially, VFFinder speeds up the silent fix identification process by up to 121% with the sameeffort reviewing 50K LOC compared to the existing approaches.Keywords: Silent vulnerability fixes, vulnerability fix identification, code change representation,graph-based model.

show abstract