Security practitioners maintain vulnerability reports (e.g., GitHub Advisory) to help developers mitigate security risks. An important task for these databases is automatically extracting structured information mentioned in the report, e.g., the affected software packages, to accelerate the defense of the vulnerability ecosystem.
However, it is challenging for existing work on affected package identification to achieve a high accuracy. One reason is that all existing work focuses on relatively smaller models, thus they cannot harness the knowledge and semantic capabilities of large language models.
To address this limitation, we propose VulLibGen, the first method to use LLM for affected package identification. In contrast to existing work, VulLibGen proposes the novel idea to directly generate the affected package. To improve the accuracy, VulLibGen employs supervised fine-tuning (SFT), retrieval augmented generation (RAG) and a local search algorithm. The local search algorithm is a novel postprocessing algorithm we introduce for reducing the hallucination of the generated packages. Our evaluation results show that VulLibGen has an average accuracy of 0.806 for identifying vulnerable packages in the four most popular ecosystems in GitHub Advisory (Java, JS, Python, Go) while the best average accuracy in previous work is 0.721. Additionally, VulLibGen has high value to security practice: we submitted 60 <vulnerability, affected package> pairs to GitHub Advisory (covers four ecosystems). 34 of them have been accepted and merged and 20 are pending approval. Our code and dataset can be found in the attachments.
Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion
Hanoi University of Science and Technology（河内理工大学）；The University of Sydney（悉尼大学）；Singapore Management University（新加坡管理大学）；The University of Melbourne（墨尔本大学）；Phenikaa University（菲尼卡大学）；Singapore University of Technology and Design（新加坡科技设计大学）
我们引入了一个新的概念，称为名称混淆，并演示了如何可以利用它来挫败多个类的代码重用攻击。通过建立在名称混淆，我们得到幻影名称系统（PNS）：一个安全协议，提供多个名称（地址）的程序指令。与指令和虚拟内存地址之间一对一映射的传统虚拟内存模型不同，PNS为同一指令创建N个映射，并在运行时在它们之间随机切换。PNS在基本块的粒度上实现了快速随机化，这减轻了一类称为（即时）代码重用的攻击。如果攻击者使用与内存安全相关的漏洞导致任何指令地址与提取期间选择的地址不同，则被利用的程序将崩溃。我们定量评估了PNS如何通过将典型漏洞的成功概率降低至约$10^{-12}$来减轻现实世界的代码重用攻击。我们实现了PNS，并通过运行SPEC CPU 2017基准测试套件对其进行了验证。通过将其添加到FPGA上的RISC-V核中，进一步验证了其实用性。最后，PNS主要是为资源受限（wimpy）设备设计的，与商用的、最先进的、基于硬件的保护相比，性能开销可以忽略不计。
BugMagnifier: TON Transaction Simulator for Revealing Smart Contract Vulnerabilities
Skolkovo Institute of Science and Technology（斯科尔科沃科学与技术学院）；Moscow Institute of Physics and Technology（莫斯科物理技术学院）；Positive Technologies（正数技术）；Lomonosov Moscow State University（莫斯科国立罗蒙诺索夫大学）；Indian Institute of Technology, Delhi（印度理工学院德里分校）
SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model
School of Information, Renmin University of China（中国人民大学信息学院）；Institute for Advanced Algorithms Research（高级算法研究院）；School of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）
