软件供应商通常会悄悄发布安全补丁，却不提供充分的安全公告（如Common Vulnerabilities and Exposures，即通用漏洞披露），也不会通过National Vulnerability Database（国家漏洞数据库）等资源及时更新信息。因此，检测这些安全补丁对于保障软件维护的安全性至关重要。然而现有方法面临以下挑战：（1）它们主要关注补丁本身的信息，忽略了仓库中的复杂依赖关系；（2）安全补丁通常涉及多个函数和文件，增加了充分学习其表示的难度。为缓解上述挑战，本文提出了一个名为RepoSPD的仓库级安全补丁检测框架，该框架包含三个核心组件：1）仓库级图构建模块RepoCPG，通过在仓库层面合并补丁前与补丁后的源代码来表示软件补丁；2）结构感知补丁表示模块，融合图分支与序列分支，旨在理解多处代码变更之间的关联；3）渐进式学习模块，帮助模型平衡语义信息与结构信息。为评估RepoSPD的性能，我们采用了安全补丁检测领域两个广泛使用的数据集：SPI-DB和PatchDB。我们进一步将这些数据集扩展到仓库级别，分别纳入了总计20238个和28781个C/C++编程语言的仓库版本，记为SPI-DB*和PatchDB*。我们将RepoSPD与6种现有的安全补丁检测方法以及5种静态工具进行了对比。实验结果表明，RepoSPD的性能优于当前最优基线，在两个数据集上的准确率分别提升了11.90%和3.10%。
英文摘要：
Software vendors often silently release security patches without providing sufficient advisories (e.g., Common Vulnerabilities and Exposures) or delayed updates via resources (e.g., National Vulnerability Database). Therefore, it has become crucial to detect these security patches to ensure secure software maintenance. However, existing methods face the following challenges: (1) They primarily focus on the information within the patches themselves, overlooking the complex dependencies in the repository. (2) Security patches typically involve multiple functions and files, increasing the difficulty in well learning the representations. To alleviate the above challenges, this paper proposes a Repository-level Security Patch Detection framework named RepoSPD, which comprises three key components: 1) a repository-level graph construction, RepoCPG, which represents software patches by merging pre-patch and post-patch source code at the repository level; 2) a structure-aware patch representation, which fuses the graph and sequence branch and aims at comprehending the relationship among multiple code changes; 3) progressive learning, which facilitates the model in balancing semantic and structural information. To evaluate RepoSPD, we employ two widely-used datasets in security patch detection: SPI-DB and PatchDB. We further extend these datasets to the repository level, incorporating a total of 20,238 and 28,781 versions of repository in C/C++ programming languages, respectively, denoted as SPI-DB* and PatchDB*. We compare RepoSPD with six existing security patch detection methods and five static tools. Our experimental results demonstrate that RepoSPD outperforms the state-of-the-art baseline, with improvements of 11.90%, and 3.10% in terms of accuracy on the two datasets, respectively.
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
National Institute of Standards and Technology（美国国家标准与技术研究院）；Université Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；CNRS（法国国家科学研究中心）；University of Maryland, College Park（马里兰大学帕克分校）
University of Maryland, Baltimore County（马里兰大学巴尔的摩县分校）
Open-Source Projects and Libraries are being used in software development while also bearing multiple security vulnerabilities. This use of third party ecosystem creates a new kind of attack surface for a product in development. An intelligent attacker can attack a product by exploiting one of the vulnerabilities present in linked projects and libraries. In this paper, we mine threat intelligence about open source projects and libraries from bugs and issues reported on public code repositories. We also track library and project dependencies for installed software on a client machine. We repres…
With the increasing usage of open-source software (OSS) components, vulnerabilities embedded within them are propagated to a huge number of underlying applications. In practice, the timely application of security patches in downstream software is challenging. The main reason is that such patches do not explicitly indicate their security impacts in the documentation, which would be difficult to recognize for software maintainers and users. However, attackers can still identify these "secret" security patches by analyzing the source code and generate corresponding exploits to compromise not only…
Security patches in open-source software, providing security fixes to identified vulnerabilities, are crucial in protecting against cyberattacks. Despite the National Vulnerability Database (NVD) publishes identified vulnerabilities, a vast majority of vulnerabilities and their corresponding security patches remain beyond public exposure, e.g., in the open-source libraries that are heavily relied on by developers. An extensive security patches dataset could help end-users such as security companies, e.g., building a security knowledge base, or researchers, e.g., aiding in vulnerability researc…
Not All Correct Fixes Run Alike: An Empirical Study of Patch Performance in Repository-Level Issue Resolution
The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新技术开发区（滨江）区块链与数据安全研究院）；Graz University of Technology（格拉茨工业大学）
该研究以SWE-bench等基准的F2P测试为工具，搭配Claude Opus 5等模型与SWE-agent，发现LLM生成补丁的运行时性能与问题解决率无关，需将补丁性能纳入仓库级问题解决的评估。
Empirical Study of Code Large Language Models for Binary Security Patch Detection
National Key Laboratory for Novel Software Technology at Nanjing University（南京大学新型软件技术国家重点实验室）；Harbin Institute of Technology（哈尔滨工业大学）；Chinese University of Hong Kong（香港中文大学）；Hong Kong University of Science and Technology（香港科学大学）
A.S.E: A Repository-Level Benchmark for Evaluating Security in AI-Generated Code
Tencent（腾讯公司）；Peking University（北京大学）；Fudan University（复旦大学）；Shanghai Jiao Tong University（上海交通大学）；Tsinghua University（清华大学）；Zhejiang University（浙江大学）；Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；Singapore Management University（新加坡国立大学）
The absolute majority of software today is developed collaboratively using collaborative version control tools such as Git. It is a common practice that once a vulnerability is detected and fixed, the developers behind the software issue a Common Vulnerabilities and Exposures or CVE record to alert the user community of the security hazard and urge them to integrate the security patch. However, some companies might not disclose their vulnerabilities and just update their repository. As a result, users are unaware of the vulnerability and may remain exposed. In this paper, we present a system t…
Security of mobile apps affects the security of their users. This has fueled the development of techniques to automatically detect vulnerabilities in mobile apps and help developers secure their apps; specifically, in the context of Android platform due to openness and ubiquitousness of the platform. Despite a slew of research efforts in this space, there is no comprehensive repository of up-to-date and lean benchmarks that contain most of the known Android app vulnerabilities and, consequently, can be used to rigorously evaluate both existing and new vulnerability detection techniques and hel…
Training machine learning approaches for vulnerability identification and producing reliable tools to assist developers in implementing quality software -- free of vulnerabilities -- is challenging due to the lack of large datasets and real data. Researchers have been looking at these issues and building datasets. However, these datasets usually miss natural language artifacts and programming language diversity. We scraped the entire CVE details database for GitHub references and augmented the data with 3 security-related datasets. We used the data to create a ground-truth dataset of natural l…
PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software
East China Normal University（华东师范大学）；Continental-NTU Corporate Lab（大陆-南洋理工大学企业实验室）；Nanyang Technological University（南洋理工大学）；College of Intelligence and Computing, Tianjin University（天津大学智能与计算学部）；Shanghai Key Laboratory of Trustworthy Computing, East China Normal University（华东师范大学上海可信计算重点实验室）
Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of…
Several studies have shown that automated support for different activities of the security patch management process has great potential for reducing delays in installing security patches. However, it is also important to understand how automation is used in practice, its limitations in meeting real-world needs and what practitioners really need, an area that has not been empirically investigated in the existing software engineering literature. This paper reports an empirical study aimed at investigating different aspects of automation for security patch management using semi-structured intervi…
Timely patching is paramount to safeguard users and maintainers against dire consequences of malicious attacks. In practice, patching is prioritized following the nature of the code change that is committed in the code repository. When such a change is labeled as being security-relevant, i.e., as fixing a vulnerability, maintainers rapidly spread the change and users are notified about the need to update to a new version of the library or of the application. Unfortunately, oftentimes, some security-relevant changes go unnoticed as they represent silent fixes of vulnerabilities. In this paper, …
Background: Testing and validation of the semantic correctness of patches provided by tools for Automated Program Repairs (APR) has received a lot of attention. Yet, the eventual acceptance or rejection of suggested patches for real world projects by humans patch reviewers has received a limited attention. Objective: To address this issue, we plan to investigate whether (possibly incorrect) security patches suggested by APR tools are recognized by human reviewers. We also want to investigate whether knowing that a patch was produced by an allegedly specialized tool does change the decision of …
Numerous security attacks that resulted in devastating consequences can be traced back to a delay in applying a security patch. Despite the criticality of timely patch application, not much is known about why and how delays occur when applying security patches in practice, and how the delays can be mitigated. Based on longitudinal data collected from 132 delayed patching tasks over a period of four years and observations of patch meetings involving eight teams from two organisations in the healthcare domain, and using quantitative and qualitative data analysis approaches, we identify a set of …
Context: Software security patch management purports to support the process of patching known software security vulnerabilities. Given the increasing recognition of the importance of software security patch management, it is important and timely to systematically review and synthesise the relevant literature on this topic. Objective: This paper aims at systematically reviewing the state of the art of software security patch management to identify the socio-technical challenges in this regard, reported solutions (i.e., approaches, tools, and practices), the rigour of the evaluation and the indu…
Automated Detection of Configuration-Specific Security Vulnerabilities via Patch Analysis
Federal University of Bahia（巴伊亚联邦大学）；University of Notre Dame（圣母大学）；Federal Rural University of Pernambuco（伯南布哥联邦农村大学）；Federal University of Rio de Janeiro（里约热内卢联邦大学）
PatUntrack: Automated Generating Patch Examples for Issue Reports without Tracked Insecure Code
Institute of Software Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beihang University（北京航空航天大学）；The University of Queensland（昆士兰大学）
Security is a requirement of utmost importance to produce high-quality software. However, there is still a considerable amount of vulnerabilities being discovered and fixed almost weekly. We hypothesize that developers affect the maintainability of their codebases when patching vulnerabilities. This paper evaluates the impact of patches to improve security on the maintainability of open-source software. Maintainability is measured based on the Better Code Hub's model of 10 guidelines on a dataset, including 1300 security-related commits. Results show evidence of a trade-off between security an…
We present PTracer, a Linux kernel patch trace bot based on an improved PatchNet. PTracer continuously monitors new patches in the git repository of the mainline Linux kernel, filters out unconcerned ones, classifies the rest as bug-fixing or non bug-fixing patches, and reports bug-fixing patches to the kernel experts of commercial operating systems. We use the patches in February 2019 of the mainline Linux kernel to perform the test. As a result, PTracer recommended 151 patches to CGEL kernel experts out of 5,142, and 102 of which were accepted. PTracer has been successfully applied to a comm…
