D2A：基于差分分析的基于AI的漏洞检测方法的数据集
D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis
摘要：
静态分析工具被广泛用于漏洞检测，因为它们理解具有复杂行为和数百万行代码的程序。尽管静态分析工具很受欢迎，但已知它们会产生过多的误报。最近机器学习模型理解程序设计语言的能力在应用于静态分析时开辟了新的可能性。然而，现有的数据集训练模型的弱点识别遭受多重限制，如有限的错误上下文，有限的大小，合成和不切实际的源代码。我们提出了D2A，一个基于差异分析的方法来标记由静态分析工具报告的问题。D2A数据集是通过分析来自多个开源项目的版本对构建的。从每个项目中，我们选择bug修复提交，并对提交前后的版本运行静态分析。如果在提交前版本中检测到的一些问题在相应的提交后版本中消失了，那么它们很可能是真正的bug，并通过提交得到了修复。我们使用D2A生成一个大的标记数据集来训练模型进行漏洞识别。我们表明，该数据集可用于构建分类器，以识别静态分析报告的问题中可能的误报，从而帮助开发人员优先考虑和调查潜在的真阳性。
英文摘要：
Static analysis tools are widely used for vulnerability detection as they understand programs with complex behavior and millions of lines of code. Despite their popularity, static analysis tools are known to generate an excess of false positives. The recent ability of Machine Learning models to understand programming languages opens new possibilities when applied to static analysis. However, existing datasets to train models for vulnerability identification suffer from multiple limitations such as limited bug context, limited size, and synthetic and unrealistic source code. We propose D2A, a differential analysis based approach to label issues reported by static analysis tools. The D2A dataset is built by analyzing version pairs from multiple open source projects. From each project, we select bug fixing commits and we run static analysis on the versions before and after such commits. If some issues detected in a before-commit version disappear in the corresponding after-commit version, they are very likely to be real bugs that got fixed by the commit. We use D2A to generate a large labeled dataset to train models for vulnerability identification. We show that the dataset can be used to build a classifier to identify possible false alarms among the issues reported by static analysis, hence helping developers prioritize and investigate potential true positives first.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
