.png){kind=icon}
返回
SeqTrans: Automatic Vulnerability Fix Via Sequence to Sequence Learning
.png){kind=icon}
OA
AI
DOI：10.1109/TSE.2022.3156637.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Software vulnerabilities are now reported unprecedentedly due to the recent development of automated vulnerability hunting tools. However, fixing vulnerabilities still mainly depends on programmers' manual efforts. Developers need to deeply understand the vulnerability and affect the system's functions as little as possible. In this paper, with the advancement of Neural Machine Translation (NMT) techniques, we provide a novel approach called SeqTrans to exploit historical vulnerability fixes to provide suggestions and automatically fix the source code. To capture the contextual information around the vulnerable code, we propose to leverage data-flow dependencies to construct code sequences and feed them into the state-of-the-art transformer model. The fine-tuning strategy has been introduced to overcome the small sample size problem. We evaluate SeqTrans on a dataset containing 1,282 commits that fix 624 CVEs in 205 Java projects. Results show that the accuracy of SeqTrans outperforms the latest techniques and achieves 23.3% in statement-level fix and 25.3% in CVE-level fix. In the meantime, we look deep inside the result and observe that the NMT model performs very well in certain kinds of vulnerabilities like CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization).
Keyword:
Maintenance engineering
Codes
Computer bugs
Predictive models
Transformers
Decoding
Training
Machine learning
neural machine translation
software engineering
vulnerability fix
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
Cysteine Dioxygenase 1 Is a Tumor Suppressor Gene Silenced by Promoter Methylation in Multiple Human Cancers半胱氨酸双加氧酶1是一种在多种人类癌症中被启动子甲基化沉默的抑癌基因.png)
PLoS ONE
OAAI
PLoS ONEIF0
OAAI分享收藏Role of Macroautophagy in Nutrient Homeostasis During Fungal Development and PathogenesisCellsOAAI
CellsIF0
OAAI分享收藏
查看更多内容