Abstract:Security patches in open source software, providing security fixes to identified vulnerabilities, are crucial in protecting against cyber attacks. Security advisories and announcements are often publicly released to inform the users about potential security vulnerability. Despite the National Vulnerability Database (NVD) publishes identified vulnerabilities, a vast majority of vulnerabilities and their corresponding security patches remain beyond public exposure, e.g., in the open source libraries that are heavily relied on by developers. As many of these patches exist in open sourced projects, the problem of curating and gathering security patches can be difficult due to their hidden nature. An extensive and complete security patches dataset could help end-users such as security companies, e.g., building a security knowledge base, or researcher, e.g., aiding in vulnerability research. To efficiently curate security patches including undisclosed patches at large scale and low cost, we propose a deep neural-network-based approach built upon commits of open source repositories. First, we design and build security patch datasets that include 38,291 security-related commits and 1,045 Common Vulnerabilities and Exposures (CVE) patches from four large-scale C programming language libraries. We manually verify each commit, among the 38,291 security-related commits, to determine if they are security related. We devise and implement a deep learning-based security patch identification system that consists of two composite neural networks: one commit-message neural network that utilizes pretrained word representations learned from our commits dataset and one code-revision neural network that takes code before revision and after revision and learns the distinction on the statement level. Our system leverages the power of the two networks for Security Patch Identification. Evaluation results show that our system significantly outperforms SVM and K-fold stacking algorithms. The result on the combined dataset achieves as high as 87.93% F1-score and precision of 86.24%. We deployed our pipeline and learned model in an industrial production environment to evaluate the generalization ability of our approach. The industrial dataset consists of 298,917 commits from 410 new libraries that range from a wide functionalities. Our experiment results and observation on the industrial dataset proved that our approach can identify security patches effectively among open sourced projects.

VCIPR: Vulnerable Code is Identifiable When a Patch is Released (Hacker's Perspective)

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

PS3: Precise Patch Presence Test Based on Semantic Symbolic Signature

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

Understanding Vulnerability Inducing Commits of the Linux Kernel

CompVPD: Iteratively Identifying Vulnerability Patches Based on Human Validation Results with a Precise Context

Mvp: Detecting Vulnerabilities Using Patch-Enhanced Vulnerability Signatures

PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software

Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries

Vulnerability discovery based on source code patch commit mining: a systematic literature review

ICSPatch: Automated Vulnerability Localization and Non-Intrusive Hotpatching in Industrial Control Systems using Data Dependence Graphs

Deep ahead-of-threat virtual patching

AutoPaG: towards automated software patch generation with source code root cause identification and repair

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

VulSlicer: Vulnerability detection through code slicing

SPAIN: security patch analysis for binaries towards understanding the pain and pills.

How to build a vulnerability benchmark to overcome cyber security attacks

HGVul: A Code Vulnerability Detection Method Based on Heterogeneous Source-Level Intermediate Representation

Enhancing Security in Third-Party Library Reuse -- Comprehensive Detection of 1-day Vulnerability through Code Patch Analysis

SPI: Automated Identification of Security Patches via Commits