SeqTrans: Automatic Vulnerability Fix Via Sequence to Sequence Learning

Chi, Jianlei; Qu, Yu; Liu, Ting; Zheng, Qinghua; Yin, Heng

doi:10.1109/tse.2022.3156637

Cited by 29 publications

(27 citation statements)

References 72 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Abadi et al [1] developed a tool specifically for fixing injection vulnerabilities by placing sanitizers on the right place in the code. More recently, SeqTrans [8], VuRLE [24], and SEADER [54] are tools that leveraged existing repair patterns to produce vulnerability patches. Despite these studies, an independent evaluation of the the repair rate on a broader set of vulnerabilities is still lacking as the the source code of SeqTrans [8], and SEADER [54] has been only recently published.…”

Section: Related Workmentioning

confidence: 99%

“…The source code for the two APR4Sectools SEADER [54] and SeqTrans [8] have just been released. Therefore, we did not have Table 3: Tools used in experiment.…”

Section: Choice Of Toolsmentioning

confidence: 99%

“…Cardumen [27] jGenProg [26] jKali [26] Astor TBar [21] Independent Generic SEADER [54] SeqTrans [8] Independent Security…”

Section: Toolmentioning

confidence: 99%

“…We also limit the tool scope to Java test-based APR tools which then we can validate the correctness before using the patches for the experiment. We will add the APR tools designed for security (either SeqTrans [8] or SEADER [54]) to Table 4 after we get their correctness result on the chosen CVEs.…”

Section: Toolmentioning

confidence: 99%

“…The applicability of APR tools designed for security has also been the subject of some comparative case studies [35]. Recently, specialized tools for security vulnerabilities such as SeqTrans [8], VuRLE [24], and SEADER [54] have also been recently proposed, albeit not yet independently evaluated.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

On the acceptance by code reviewers of candidate security patches suggested by Automated Program Repair tools

Papotti¹,

Paramitha²,

Massacci³

2022

Preprint

View full text Add to dashboard Cite

Background: Testing and validation of the semantic correctness of patches provided by tools for Automated Program Repairs (APR) has received a lot of attention. Yet, the eventual acceptance or rejection of suggested patches for real world projects by humans patch reviewers has received a limited attention. Objective: To address this issue, we plan to investigate whether (possibly incorrect) security patches suggested by APR tools are recognized by human reviewers. We also want to investigate whether knowing that a patch was produced by an allegedly specialized tool does change the decision of human reviewers. Method: In the first phase, using a balanced design, we propose to human reviewers a combination of patches proposed by APR tools for different vulnerabilities and ask reviewers to adopt or reject the proposed patches. In the second phase, we tell participants that some of the proposed patches were generated by security specialized tools (even if the tool was actually a 'normal' APR tool) and measure whether the human reviewers would change their decision to adopt or reject a patch. Limitations: The experiment will be conducted in an academic setting, and to maintain power, it will focus on a limited sample of popular APR tools and popular vulnerability types.

show abstract

Section: Related Workmentioning

confidence: 99%

“…The source code for the two APR4Sectools SEADER [54] and SeqTrans [8] have just been released. Therefore, we did not have Table 3: Tools used in experiment.…”

Section: Choice Of Toolsmentioning

confidence: 99%

“…Cardumen [27] jGenProg [26] jKali [26] Astor TBar [21] Independent Generic SEADER [54] SeqTrans [8] Independent Security…”

Section: Toolmentioning

confidence: 99%

Section: Toolmentioning

confidence: 99%