Pre-Trained Model-Based Automated Software Vulnerability Repair: How Far are We?

Zhang, Quanjun; Fang, Chunrong; Yu, Bowen; Sun, Weisong; Zhang, Tongke; Chen, Zhenyu

doi:10.1109/tdsc.2023.3308897

Cited by 6 publications

(1 citation statement)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Pretrained-based vulnerability repair uses pretrained models (often deep learning or language models) to identify and repair software vulnerabilities. The models can be trained on our FixMe dataset, learning patterns that can help detect vulnerabilities and suggest fixes, as in [36].…”

Section: Applications Of Fixmementioning

confidence: 99%

An Incremental Lightweight Method for Vulnerability Data Collection for Security Patches

Bhandari,

Gavric

2024

Preprint

View full text Add to dashboard Cite

Automated Program Repair enhances developers’ efficiency by reducing the time dedicated to debugging and fixing source code vulnerabilities. However, the existing datasets utilized to train patch generation models suffer from various limitations, notably the limited bug context, limited size, and reliance on synthetic and unrealistic source code samples. Additionally, existing dataset extraction tools lack an incremental approach, rendering the inclusion of new data a resource-intensive endeavor in terms of both time and computational resources. In this paper, we introduce FixMe , a novel framework designed for generating patches across diverse programming languages. This open-source tool facilitates an incremental approach to gathering vulnerability records from the Common Vulnerabilities and Exposures (CVE) database. Incorporating an incremental methodology accelerates the data acquisition process, encompassing newly identified vulnerabilities and their corresponding patch pairs. Our dataset curation method involves the extraction of security issues, acquiring vulnerability-fixing commits, and extracting source code from relevant projects. The resultant dataset comprises 18,063 CVEs from 2,133 commits, encompassing 19,109 patch sets with 44,059 vulnerability-fix pairs (patch hunks). This dataset spans 884 open-source projects hosted in git-based systems. Additionally , the study explores fostering the potential of APR techniques in reducing debugging costs and improving software quality by generating patches for fixing vulnerabilities automatically.

show abstract

Section: Applications Of Fixmementioning

confidence: 99%