.png){kind=icon}
返回
Multi-Granularity Detector for Vulnerability Fixes
.png){kind=icon}
OA
AI
DOI：10.1109/TSE.2023.3281275.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
With the increasing reliance on Open Source Software, users are exposed to third-party library vulnerabilities. Software Composition Analysis (SCA) tools have been created to alert users of such vulnerabilities. SCA requires the identification of vulnerability-fixing commits. Prior works have proposed methods that can automatically identify such vulnerability-fixing commits. However, identifying such commits is highly challenging, as only a very small minority of commits are vulnerability fixing. Moreover, code changes can be noisy and difficult to analyze. We observe that noise can occur at different levels of detail, making it challenging to detect vulnerability fixes accurately. To address these challenges and boost the effectiveness of prior works, we propose MiDas (Multi-Granularity Detector for Vulnerability Fixes). Unique from prior works, MiDas constructs different neural networks for each level of code change granularity, corresponding to commit-level, file-level, hunk-level, and line-level, following their natural organization and then use an ensemble model combining all base models to output the final prediction. This design allows MiDas to better cope with the noisy and highly-imbalanced nature of vulnerability-fixing commit data. In addition, to reduce the human effort required to inspect code changes, we have designed an effort-aware adjustment for MiDas's outputs based on commit length. The evaluation result demonstrates that MiDas outperforms the current state-of-the-art baseline on both Java and Python-based datasets in terms of AUC by 4.9% and 13.7%, respectively. Furthermore, in terms of two effort-aware metrics, i.e., EffortCost@L and Popt@L, MiDas also performs better than the state-of-the-art baseline up to 28.2% and 15.9% on Java, 60% and 51.4% on Python, respectively.
Keyword:
Vulnerability-fixing commit classification
machine learning
deep learning
software security
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
Visual Responses in FEF, Unlike V1, Primarily Reflect When the Visual Context Renders a Receptive Field Salient与V1不同，FEF中的视觉反应主要反映了视觉环境何时使感受野显着
OAAI
OAAI分享收藏Sperm chromatin acquires an activity that induces microtubule assembly during residence in the cytoplasm of metaphase oocytes of the mouse.png)
Chromosoma
ChromosomaIF0
PREAI
分享收藏THE MEANING AND USE OF THE AREA UNDER A RECEIVER OPERATING CHARACTERISTIC (ROC) CURVE受试者工作特征 (ROC) 曲线下面积的含义和用途RADIOLOGY
RADIOLOGYIF15.2
PREAI
分享收藏
查看更多内容