ENCORE: Ensemble Learning using Convolution Neural Machine Translation for Automatic Program Repair

Lutellier, Thibaud; Pang, Lawrence; Phạm, Việt Hùng; Wei, Moshi; Lin, Tao

doi:10.48550/arxiv.1906.08691

Cited by 5 publications

(9 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We create a bug fix corpus by mining the GitHub development platform. We follow the procedures in related works [26], [46] and collect our bug fixing dataset by filtering GitHub commits to C code projects based on keywords such as 'bug' or 'vulnerability' in the commit message. Filtering commits based on commit messages can be imprecise and generate false positives.…”

Section: Bug Fix Corpusmentioning

confidence: 99%

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Chen

Kommrusch

Monperrus

2023

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

In this paper, we address the problem of automatic repair of software vulnerabilities with deep learning. The major problem with data-driven vulnerability repair is that the few existing datasets of known confirmed vulnerabilities consist of only a few thousand examples. However, training a deep learning model often requires hundreds of thousands of examples. In this work, we leverage the intuition that the bug fixing task and the vulnerability fixing task are related and that the knowledge learned from bug fixes can be transferred to fixing vulnerabilities. In the machine learning community, this technique is called transfer learning. In this paper, we propose an approach for repairing security vulnerabilities named VRepair which is based on transfer learning. VRepair is first trained on a large bug fix corpus and is then tuned on a vulnerability fix dataset, which is an order of magnitude smaller. In our experiments, we show that a model trained only on a bug fix corpus can already fix some vulnerabilities. Then, we demonstrate that transfer learning improves the ability to repair vulnerable C functions. We also show that the transfer learning model performs better than a model trained with a denoising task and fine-tuned on the vulnerability fixing task. To sum up, this paper shows that transfer learning works well for repairing security vulnerabilities in C compared to learning on a small dataset.

show abstract

Section: Bug Fix Corpusmentioning

confidence: 99%

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Chen

Kommrusch

Monperrus

2023

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

show abstract

“…To train a vulnerability fixing seq2seq model with knowledge transferred from the bug fixing task, we need a large bug fixing dataset and a vulnerability fixing dataset. We follow the procedures in related works [16], [40] and collect our bug fixing dataset by filtering GitHub commits to C code projects based on keywords such as 'bug' or 'vulnerability' in the commit message. Filtering commits based on commit messages can be imprecise and generate false positives.…”

Section: Overviewmentioning

confidence: 99%

“…Next, we filter bug fix commits as follows. Per the related work [16], [40], we adopt a keyword-based heuristic: if the commit message contains keywords (fix OR solve OR repair) AND (bug OR issue OR problem OR error OR fault OR vulnerability), we consider it a bug fix commit and add it to our corpus. In total, we have analyzed 729 million (728 916 054) commits and selected 21 million (20 568 128) commits identified as bug fix commits.…”

Section: Bug Fix Corpusmentioning

confidence: 99%

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Chen,

Kommrusch,

Monperrus

2021

Preprint

View full text Add to dashboard Cite

In this paper, we address the problem of automatic repair of software vulnerabilities with deep learning. The major problem with data-driven vulnerability repair is that the few existing datasets of known confirmed vulnerabilities consist of only a few thousand examples. However, training a deep learning model often requires hundreds of thousands of examples. In this work, we leverage the intuition that the bug fixing task and the vulnerability fixing task are related, and the knowledge learned from bug fixes can be transferred to fixing vulnerabilities. In the machine learning community, this technique is called transfer learning. In this paper, we propose an approach for repairing security vulnerabilities named VRepair which is based on transfer learning. VRepair is first trained on a large bug fix corpus, and is then tuned on a vulnerability fix dataset, which is an order of magnitudes smaller. In our experiments, we show that a model trained only on a bug fix corpus can already fix some vulnerabilities. Then, we demonstrate that transfer learning improves the ability to repair vulnerable C functions. In the end, we present evidence that transfer learning produces more stable and superior neural models for vulnerability repair.

show abstract

“…We also discard all follow-up conversations to a previous review because they contain incomplete information in our context. Following previous studies in the literature [25,43,24,44,45], we intend to work on program repair in Java files only. Hence, for our experiments, we only work on the .java files.…”

Section: Project Namementioning

confidence: 99%

“…Hata et al [87] performed automatic patch generation with neural machine translation. ENCORE [45] used an ensemble of multiple Convolutional Neural Network [88] based Neural Machine Translation models to improve the performance of Deep Learning-based APR.…”

Section: Related Workmentioning

confidence: 99%

Review4Repair: Code Review Aided Automatic Program Repairing

Huq¹,

Hasan²,

Pantho³

et al. 2020

Preprint

View full text Add to dashboard Cite

Context: Learning-based automatic program repair techniques are showing promise to provide quality fix suggestions for detected bugs in the source code of the software. These tools mostly exploit historical data of buggy and fixed code changes and are heavily dependent on bug localizers while applying to a new piece of code. With the increasing popularity of code review, dependency on bug localizers can be reduced. Besides, the code review-based bug localization is more trustworthy since reviewers' expertise and experience are reflected in these suggestions.Objective: The natural language instructions scripted on the review comments are enormous sources of information about the bug's nature and expected solutions. However, none of the learning-based tools has utilized the review comments to fix programming bugs to the best of our knowledge. In this study, we investigate the performance improvement of repair techniques using code review comments. Method: We train a sequence-to-sequence model on 55,060 code reviews and associated code changes. We also introduce new tokenization and preprocessing approaches that help to achieve significant improvement over state-of-the-art learning-based repair techniques. Results: We boost the top-1 accuracy by 20.33% and top-10 accuracy by 34.82%. We could provide a suggestion for stylistics and non-code errors unaddressed by prior techniques.

show abstract

ENCORE: Ensemble Learning using Convolution Neural Machine Translation for Automatic Program Repair

Cited by 5 publications

References 0 publications

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Review4Repair: Code Review Aided Automatic Program Repairing

Contact Info

Product

Resources

About