AIセキュリティポータル K Program
PatUntrack: Automated Generating Patch Examples for Issue Reports without Tracked Insecure Code
Share
Abstract
Security patches are essential for enhancing the stability and robustness of projects in the software community. While vulnerabilities are officially expected to be patched before being disclosed, patching vulnerabilities is complicated and remains a struggle for many organizations. To patch vulnerabilities, security practitioners typically track vulnerable issue reports (IRs), and analyze their relevant insecure code to generate potential patches. However, the relevant insecure code may not be explicitly specified and practitioners cannot track the insecure code in the repositories, thus limiting their ability to generate patches. In such cases, providing examples of insecure code and the corresponding patches would benefit the security developers to better locate and fix the insecure code. In this paper, we propose PatUntrack to automatically generating patch examples from IRs without tracked insecure code. It auto-prompts Large Language Models (LLMs) to make them applicable to analyze the vulnerabilities. It first generates the completed description of the Vulnerability-Triggering Path (VTP) from vulnerable IRs. Then, it corrects hallucinations in the VTP description with external golden knowledge. Finally, it generates Top-K pairs of Insecure Code and Patch Example based on the corrected VTP description. To evaluate the performance, we conducted experiments on 5,465 vulnerable IRs. The experimental results show that PatUntrack can obtain the highest performance and improve the traditional LLM baselines by +14.6% (Fix@10) on average in patch example generation. Furthermore, PatUntrack was applied to generate patch examples for 76 newly disclosed vulnerable IRs. 27 out of 37 replies from the authors of these IRs confirmed the usefulness of the patch examples generated by PatUntrack, indicating that they can benefit from these examples for patching the vulnerabilities.
Slice Distance: An Insert-Only Levenshtein Distance with a Focus on Security Applications
Zeeshan Afzal, Johan Garcia, Stefan Lindskog, Anna Brunström
Published: 2018
Before we knew it: an empirical study of zero-day attacks in the real world
L. Bilge, T. Dumitraş
Published: 2012
DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection
Yizheng Chen, Zhoujie Ding, Lamya Alowain, Xinyun Chen, David Wagner
Published: 2023.4.2
How About Bug-Triggering Paths? - Understanding and Characterizing Learning-Based Vulnerability Detectors
Xiao Cheng, Xu Nie, Ningke Li, Haoyu Wang, Zheng Zheng, Yulei Sui
Published: 2024
Inference for Ever-Changing Policy of Taint Analysis
Wen-Hao Chiang, Peixuan Li, Qiang Zhou, Subarno Banerjee, Martin Schäf, Yingjun Lyu, Hoan Nguyen, Omer Tripp
Published: 2024
PyTy: Repairing Static Type Errors in Python
Yiu Wai Chow, Luca Di Grazia, Michael Pradel
Published: 2024
Automated Keyword Extraction from 'One-day' Vulnerabilities at Disclosure
Clément Elbaz, Louis Rilling, Christine Morin
Published: 2020
Bugs as Deviant Behavior: A General Approach to Inferring Errors in Systems Code
Dawson R. Engler, David Yu Chen, Andy Chou
Published: 2001
Incoder: A generative model for code infilling and synthesis
Daniel Fried, Armen Aghajanyan, Jessy Lin, Sida Wang, Eric Wallace, Freda Shi, Ruiqi Zhong, Scott Yih, Luke Zettlemoyer, Mike Lewis
Published: 2023
Identifying security bug reports via text mining: An industrial case study
Michael Gegick, Pete Rotella, Tao Xie
Published: 2010
Software vulnerability analysis and discovery using machine-learning and data-mining techniques: A survey
Seyed Mohammad Ghaffarian, Hamid Reza Shahriari
Published: 2017
Practical program repair via bytecode mutation
Ali Ghanbari, Samuel Benton, Lingming Zhang
Published: 2019
PraPR: Practical Program Repair via Bytecode Mutation
Ali Ghanbari, Lingming Zhang
Published: 2019
The cert guide to coordinated vulnerability disclosure
Allen D Householder, Garret Wassermann, Art Manion, Chris King
Published: 2017
ReDeBug: Finding Unpatched Code Clones in Entire OS Distributions
Jiyong Jang, Abeer Agrawal, David Brumley
Published: 2012
CURE: Code-Aware Neural Machine Translation for Automatic Program Repair
Nan Jiang, Thibaud Lutellier, Lin Tan
Published: 2021
Survey on software vulnerability analysis method based on machine learning
Gong Jie, Kuang Xiao-Hui, Liu Qiang
Published: 2016
A Large-Scale Study of Security Vulnerability Support on Developer Q&A Websites
Triet Huynh Minh Le, Roland Croft, David Hin, Muhammad Ali Babar
Published: 2021
A Deep Multitask Learning Approach for Requirements Discovery and Annotation from Open Forum
Mingyang Li, Lin Shi, Ye Yang, Qing Wang
Published: 2020
Sysevr: A framework for using deep learning to detect software vulnerabilities
Li, Z., Zou, D., Xu, S., Jin, H., Zhu, Y., Chen, Z.
Published: 2021
Mlsa: A static bugs analysis tool based on llvm ir
Hongliang Liang, Lei Wang, Dongyang Wu, Jiuyun Xu
Published: 2016
Software vulnerability detection using deep neural networks: A survey
G. Lin, S. Wen, Q.-L. Han, J. Zhang, Y. Xiang
Published: 2020
POSTER: Vulnerability Discovery with Function Representation Learning from Unlabeled Projects
Guanjun Lin, Jun Zhang, Wei Luo, Lei Pan, Yang Xiang
Published: 2017
Software vulnerability discovery techniques: A survey
Bingchang Liu, Liang Shi, Zhuhua Cai, Min Li
Published: 2012
Tbar: Revisiting template-based automated program repair.
Kui Liu, Anil Koyuncu, Dongsun Kim, Tegawendé F Bissyandé
Published: 2019
CoCoNuT: combining context-aware neural translation models using ensemble for program repair
Thibaud Lutellier, Hung Viet Pham, Lawrence Pang, Yitong Li, Moshi Wei, Lin Tan
Published: 2020
Share