VERCATION：基于静态分析和LLM的精确易受攻击开源软件版本识别
VERCATION: Precise Vulnerable Open-source Software Version Identification based on Static Analysis and LLM
AI总结：
本文提出VERCATION方法，结合程序切片与LLM识别漏洞相关代码，通过回溯历史提交并基于扩展规范化AST的代码克隆检测定位引入漏洞的提交，在识别C/C++开源软件易受攻击版本任务上F1达93.1%，并发现NVD报告中202个错误版本。
摘要：
开源软件（OSS）因其协作开发模式和成本效益而广受欢迎。然而，在开发项目中采用特定软件版本时，如果这些版本带有漏洞，可能会引入安全风险。当前识别易受攻击版本的方法通常使用预定义规则的静态分析来分析和提取漏洞补丁中涉及的代码特征，然后使用代码克隆检测来识别易受攻击的版本。这些方法由于（1）在分析中排除了与漏洞无关的代码，以及（2）代码克隆检测的不足，而受到不精确性的阻碍。本文提出了VERCATION，一种旨在识别用C/C++编写的OSS易受攻击版本的方法。VERCATION将程序切片与大语言模型（LLM）相结合，从漏洞补丁中识别与漏洞相关的代码。然后，它回溯历史提交以收集已识别的与漏洞相关代码的先前修改。我们提出基于扩展和规范化AST的代码克隆检测，以比较修改前和修改后代码之间的差异，从而定位引入漏洞的提交（vic），并实现漏洞修复提交与vic之间易受攻击版本的识别。我们策划了一个链接122个OSS漏洞和1,211个版本的数据集来评估VERCATION。在该数据集上，我们的方法实现了93.1%的F1分数，优于当前最先进的方法。更重要的是，VERCATION在NVD报告中检测到了202个错误的易受攻击OSS版本。
英文摘要：
Open-source software (OSS) has experienced a surge in popularity, attributed to its collaborative development model and cost-effective nature. However, the adoption of specific software versions in development projects may introduce security risks when these versions bring along vulnerabilities. Current methods of identifying vulnerable versions typically analyze and extract the code features involved in vulnerability patches using static analysis with pre-defined rules. They then use code clone detection to identify the vulnerable versions. These methods are hindered by imprecision due to (1) the exclusion of vulnerability-irrelevant code in the analysis and (2) the inadequacy of code clone detection. This paper presents VERCATION, an approach designed to identify vulnerable versions of OSS written in C/C++. VERCATION combines program slicing with a Large Language Model (LLM) to identify vulnerability-relevant code from vulnerability patches. It then backtracks historical commits to gather previous modifications of identified vulnerability-relevant code. We propose code clone detection based on expanded and normalized ASTs to compare the differences between pre-modification and post-modification code, thereby locating the vulnerability-introducing commit (vic) and enabling the identification of the vulnerable versions between the vulnerability-fixing commit and the vic. We curate a dataset linking 122 OSS vulnerabilities and 1,211 versions to evaluate VERCATION. On this dataset, our approach achieves an F1 score of 93.1%, outperforming current state-of-the-art methods. More importantly, VERCATION detected 202 incorrect vulnerable OSS versions in NVD reports.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
