Abstract:Vulnerabilities are disclosed with corresponding patches so that users can remediate them in time. However, there are instances where patches are not released with the disclosed vulnerabilities, causing hidden dangers, especially if dependent software remains uninformed about the affected code repository. Hence, it is crucial to automatically locate security patches for disclosed vulnerabilities among a multitude of commits. Despite the promising performance of existing learning-based localization approaches, they still suffer from the following limitations: (1) They cannot perform well in data scarcity scenarios. Most neural models require extensive datasets to capture the semantic correlations between the vulnerability description and code commits, while the number of disclosed vulnerabilities with patches is limited. (2) They struggle to capture the deep semantic correlations between the vulnerability description and code commits due to inherent differences in semantics and characters between code changes and commit messages. It is difficult to use one model to capture the semantic correlations between vulnerability descriptions and code commits. To mitigate these two limitations, in this paper, we propose a novel security patch localization approach named Prom VPat, which utilizes the dual prompt tuning channel to capture the semantic correlation between vulnerability descriptions and commits, especially in data scarcity (i.e., few-shot) scenarios. We first input the commit message and code changes with the vulnerability description into the prompt generator to generate two new inputs with prompt templates. Then, we adopt a pre-trained language model (i.e., PLM) as the encoder, utilize the prompt tuning method to fine-tune the encoder, and generate two correlation probabilities as the semantic features. In addition, we extract 26 handcrafted features from the vulnerability descriptions and the code commits. Finally, we utilize the attention mechanism to fuse the handcrafted and semantic features, which are fed into the classifier to predict the correlation probability and locate the security patch. To evaluate the performance of Prom VPat, we compare it with five baselines on two datasets. Experimental results demonstrate that Prom VPat performs best in the security patch localization task, improving the best baseline by 14.42 % and 86.57 % on two datasets regarding Recall@1. Moreover, Prom VPat has proven to be effective even in data scarcity scenarios.

Localizing Vulnerabilities Statistically from One Exploit

Localizing Patch Points From One Exploit

Just-In-Time Defect Identification and Localization: A Two-Phase Framework.

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

Cross-language Bug Localization.

Dual Prompt-Based Few-Shot Learning for Automated Vulnerability Patch Localization

VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detector

Context-based statement-level vulnerability localization

Attention Is All You Need for LLM-based Code Vulnerability Localization

Exploiting Library Vulnerability via Migration Based Automating Test Generation

Learning to Quantize Vulnerability Patterns and Match to Locate Statement-Level Vulnerabilities

Automated software vulnerability detection with machine learning

Research on a Multi-Level Combination of Software Defect Localization Method.

Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

A Large-Scale Empirical Study on Vulnerability Distribution Within Projects and the Lessons Learned

Locating the Security Patches for Disclosed OSS Vulnerabilities with Vulnerability-Commit Correlation Ranking

Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning?

Explaining the Contributing Factors for Vulnerability Detection in Machine Learning

Finding A Needle in a Haystack: Automated Mining of Silent Vulnerability Fixes

Towards Vulnerability Discovery Using Staged Program Analysis