Abstract:Software plays a crucial role in our daily lives, and therefore the quality and security of software systems have become increasingly important. However, vulnerabilities in software still pose a significant threat, as they can have serious consequences. Recent advances in automated program repair have sought to automatically detect and fix bugs using data-driven techniques. Sophisticated deep learning methods have been applied to this area and have achieved promising results. However, existing benchmarks for training and evaluating these techniques remain limited, as they tend to focus on a single programming language and have relatively small datasets. Moreover, many benchmarks tend to be outdated and lack diversity, focusing on a specific codebase. Worse still, the quality of bug explanations in existing datasets is low, as they typically use imprecise and uninformative commit messages as explanations. To address these issues, we propose an automated collecting framework REEF to collect REal-world vulnErabilities and Fixes from open-source repositories. We focus on vulnerabilities since they are exploitable and have serious consequences. We develop a multi-language crawler to collect vulnerabilities and their fixes, and design metrics to filter for high-quality vulnerability-fix pairs. Furthermore, we propose a neural language model-based approach to generate high-quality vulnerability explanations, which is key to producing informative fix messages. Through extensive experiments, we demonstrate that our approach can collect high-quality vulnerability-fix pairs and generate strong explanations. The dataset we collect contains 4,466 CVEs with 30,987 patches (including 236 CWE) across 7 programming languages with detailed related information, which is superior to existing benchmarks in scale, coverage, and quality. Evaluations by human experts further confirm that our framework produces high-quality vulnerability explanations.

SETC: A Vulnerability Telemetry Collection Framework

CBTracer

SEVE: Symbolic Execution Based Vulnerability Exploring System

Tunter: Assessing Exploitability of Vulnerabilities with Taint-Guided Exploitable States Exploration

Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

Automated Vulnerability Discovery And Exploitation In The Internet Of Things

From Proof-of-concept to Exploitable

Adaptive and Proactive Security Assessment on Energy Delivery Systems

REEF: A Framework for Collecting Real-World Vulnerabilities and Fixes

Development of a System Vulnerability Analysis Tool for Assessment of Complex Mission Critical Systems

Exploit Prediction Scoring System (EPSS)

Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting

Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights

Codesentry: Revolutionizing Real-Time Software Vulnerability Detection With Optimized GPT Framework

Enhancing Security Testing Software for Systems that Cannot be Subjected to the Risks of Penetration Testing Through the Incorporation of Multi-threading and and Other Capabilities

Accurate and Efficient Exploit Capture and Classification

AutoExploit: Automatic Exploit Generation with Security Mitigation

VulnEx: Exploring Open-Source Software Vulnerabilities in Large Development Organizations to Understand Risk Exposure

Revery

Revery: From Proof-Of-Concept To Exploitable (One Step Towards Automatic Exploit Generation)

SeCTIS: A Framework to Secure CTI Sharing