Abstract:Software plays a crucial role in our daily lives, and therefore the quality and security of software systems have become increasingly important. However, vulnerabilities in software still pose a significant threat, as they can have serious consequences. Recent advances in automated program repair have sought to automatically detect and fix bugs using data-driven techniques. Sophisticated deep learning methods have been applied to this area and have achieved promising results. However, existing benchmarks for training and evaluating these techniques remain limited, as they tend to focus on a single programming language and have relatively small datasets. Moreover, many benchmarks tend to be outdated and lack diversity, focusing on a specific codebase. Worse still, the quality of bug explanations in existing datasets is low, as they typically use imprecise and uninformative commit messages as explanations. To address these issues, we propose an automated collecting framework REEF to collect REal-world vulnErabilities and Fixes from open-source repositories. We focus on vulnerabilities since they are exploitable and have serious consequences. We develop a multi-language crawler to collect vulnerabilities and their fixes, and design metrics to filter for high-quality vulnerability-fix pairs. Furthermore, we propose a neural language model-based approach to generate high-quality vulnerability explanations, which is key to producing informative fix messages. Through extensive experiments, we demonstrate that our approach can collect high-quality vulnerability-fix pairs and generate strong explanations. The dataset we collect contains 4,466 CVEs with 30,987 patches (including 236 CWE) across 7 programming languages with detailed related information, which is superior to existing benchmarks in scale, coverage, and quality. Evaluations by human experts further confirm that our framework produces high-quality vulnerability explanations.

Enabling Automatic Repair of Source Code Vulnerabilities Using Data-Driven Methods

The Future Can’t Help Fix the Past: Assessing Program Repair in the Wild

CRepair: CVAE-based Automatic Vulnerability Repair Technology

Using Sequence-to-Sequence Learning for Repairing C Vulnerabilities

How Effective Are Neural Networks for Fixing Security Vulnerabilities

Automated software vulnerability detection with machine learning

Towards More Reliable Automated Program Repair by Integrating Static Analysis Techniques

A Survey of Automatic Software Vulnerability Detection, Program Repair, and Defect Prediction Techniques

Leveraging Static Analysis for Bug Repair

Pre-trained Model-based Automated Software Vulnerability Repair: How Far are We?

REEF: A Framework for Collecting Real-World Vulnerabilities and Fixes

An Empirical Study on Real Bug Fixes

Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

Enhanced Automated Code Vulnerability Repair using Large Language Models

LLM-Powered Code Vulnerability Repair with Reinforcement Learning and Semantic Reward

NAVRepair: Node-type Aware C/C++ Code Vulnerability Repair

Predicting Vulnerability In Large Codebases With Deep Code Representation

Survey of Source Code Vulnerability Analysis Based on Deep Learning

There are More Fish in the Sea: Automated Vulnerability Repair via Binary Templates

Automated Mapping of Vulnerability Advisories onto their Fix Commits in Open Source Repositories

StaticFixer: From Static Analysis to Static Repair