VulRep: vulnerability repair based on inducing commits and fixing commits.
Saved in:
| Title: | VulRep: vulnerability repair based on inducing commits and fixing commits. |
|---|---|
| Authors: | Wei, Ying1 (AUTHOR), Bo, Lili1,2 (AUTHOR) lilibo@yzu.edu.cn, Wu, Xiaoxue1 (AUTHOR), Li, Yue1 (AUTHOR), Ye, Zhenlei1 (AUTHOR), Sun, Xiaobing1,3 (AUTHOR), Li, Bin1 (AUTHOR) |
| Source: | EURASIP Journal on Wireless Communications & Networking. 4/21/2023, Vol. 2023 Issue 1, p1-16. 16p. |
| Subjects: | Repairing, Machine learning, Telecommunication systems, Information society, Wooden beams |
| Abstract: | With the rapid development of the information age, software vulnerabilities have threatened the safety of communication and mobile network, and research on vulnerability repair is urgent. Different from the existing machine learning-based approaches, we propose VulRep, a vulnerability repair approach based on vulnerability introduction, which combines empirical research findings on vulnerability inducing and vulnerability fixing commit with machine learning approaches for vulnerability repair. Firstly, we construct the vulnerability introduction and repair dataset, and generate the AST tree for the code of inducing commit and fixing commit to form a sequence after abstraction processing, and input it into the Transformer model to generate a recommendation list through beam search. After filling in the abstracted code, it is combined with the rules defined by empirical research findings, and the final patch is obtained after verification. Experimental results show that VulRep can improve the performance of repairing vulnerabilities, which illustrates the effectiveness of combined empirical research findings. In addition, we found that our approach is more suitable for repairing type CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities and can perform vulnerability repair better. [ABSTRACT FROM AUTHOR] |
| Copyright of EURASIP Journal on Wireless Communications & Networking is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Engineering Source |
|
Full text is not displayed to guests.
Login for full access.
|
|
| Abstract: | With the rapid development of the information age, software vulnerabilities have threatened the safety of communication and mobile network, and research on vulnerability repair is urgent. Different from the existing machine learning-based approaches, we propose VulRep, a vulnerability repair approach based on vulnerability introduction, which combines empirical research findings on vulnerability inducing and vulnerability fixing commit with machine learning approaches for vulnerability repair. Firstly, we construct the vulnerability introduction and repair dataset, and generate the AST tree for the code of inducing commit and fixing commit to form a sequence after abstraction processing, and input it into the Transformer model to generate a recommendation list through beam search. After filling in the abstracted code, it is combined with the rules defined by empirical research findings, and the final patch is obtained after verification. Experimental results show that VulRep can improve the performance of repairing vulnerabilities, which illustrates the effectiveness of combined empirical research findings. In addition, we found that our approach is more suitable for repairing type CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities and can perform vulnerability repair better. [ABSTRACT FROM AUTHOR] |
|---|---|
| ISSN: | 16871472 |
| DOI: | 10.1186/s13638-023-02242-7 |
