文本信息检索技术对软件缺陷的验证
Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses
摘要：
本文提出了一个初步的验证常见的文本信息检索技术映射的非结构化软件漏洞信息，以不同的软件弱点。验证是用从Snyk漏洞数据库中跟踪的四个软件存储库编译的数据集进行的。根据结果，所使用的信息检索技术执行不令人满意的正则表达式搜索相比。虽然结果因存储库而异，但初步验证表明，明确引用漏洞和弱点标识符对于具体的漏洞跟踪是更可取的。这种参考允许使用基于关键字的搜索，与信息检索技术相比，基于关键字的搜索目前似乎产生更一致的结果。然而，需要进一步的验证工作来提高技术的精确度。
英文摘要：
This paper presents a preliminary validation of common textual information retrieval techniques for mapping unstructured software vulnerability information to distinct software weaknesses. The validation is carried out with a dataset compiled from four software repositories tracked in the Snyk vulnerability database. According to the results, the information retrieval techniques used perform unsatisfactorily compared to regular expression searches. Although the results vary from a repository to another, the preliminary validation presented indicates that explicit referencing of vulnerability and weakness identifiers is preferable for concrete vulnerability tracking. Such referencing allows the use of keyword-based searches, which currently seem to yield more consistent results compared to information retrieval techniques. Further validation work is required for improving the precision of the techniques, however.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
