Abstract:Vulnerability reports play a crucial role in mitigating open-source software risks. Typically, the vulnerability report contains affected versions of a software. However, despite the validation by security expert who discovers and vendors who review, the affected versions are not always accurate. Especially, the complexity of maintaining its accuracy increases significantly when dealing with multiple versions and their differences. Several advances have been made to identify affected versions. However, they still face limitations. First, some existing approaches identify affected versions based on repository-hosting platforms (i.e., GitHub), but these versions are not always consistent with those in package registries (i.e., Maven). Second, existing approaches fail to distinguish the importance of different vulnerable methods and patched statements in face of vulnerabilities with multiple methods and change hunks. To address these problems, this paper proposes a novel approach, Vision, to accurately identify affected library versions (ALVs) for vulnerabilities. Vision uses library versions from the package registry as inputs. To distinguish the importance of vulnerable methods and patched statements, Vision performs critical method selection and critical statement selection to prioritize important changes and their context. Furthermore, the vulnerability signature is represented by weighted inter-procedural program dependency graphs that incorporate critical methods and statements. Vision determines ALVs based on the similarities between these weighted graphs. Our evaluation demonstrates that Vision outperforms state-of-the-art approaches, achieving a precision of 0.91 and a recall of 0.94. Additionally, our evaluation shows the practical usefulness of Vision in correcting affected versions in existing vulnerability databases.

Forecasting the risk of software choices: A model to foretell security vulnerabilities from library dependencies and source code evolution

Automated software vulnerability detection with machine learning

A Strategic Model of Software Dependency Networks

Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?

Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

Combining Software Metrics and Text Features for Vulnerable File Prediction

Vulnerability Severity Prediction Model for Software Based on Markov Chain.

Vulnerable Open Source Dependencies: Counting Those That Matter

VULNERLIZER: Cross-analysis Between Vulnerabilities and Software Libraries

Forecasting severity of software vulnerability using grey model GM(1,1)

A Novel Vulnerability Prediction Model to Predict Vulnerability Loss Based on Probit Regression

Vulnerability Forecasting: In theory and practice

Predicting Vulnerability In Large Codebases With Deep Code Representation

Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities

Technical Leverage in a Software Ecosystem: Development Opportunities and Security Risks

Predictive Cyber-security Analytics Framework: A non-homogenous Markov model for Security Quantification

Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures

Software Security Analysis in 2030 and Beyond: A Research Roadmap

Early Detection of Flawed Structural Dependencies During Software Evolution

Software vulnerability prediction using text analysis techniques

Software security with natural language processing and vulnerability scoring using machine learning approach