摘要
漏洞补丁为多种软件安全任务提供了重要知识,但在漏洞公告中常常缺失。提出一种面向开源软件漏洞的自动化补丁查找与解析方法PatFinder。该方法先从大量网页中识别漏洞相关的代码提交,再基于代码变更内容及加权投票的机制实现补丁筛选,最后,通过定制化的补丁解析方法,获取文件路径、函数名等补丁元数据信息。实验结果表明,该方法可达到73.10%的补丁覆盖率和0.802的补丁查全率,大幅提升了现有方法的补丁覆盖率和查全率。
Patches,as a valuable piece of information for security-related tasks,are often missing in security advisories.In this article,we propose an automated approach,named PatFinder,to find and parse patches for open source software(OSS)vulnerabilities.First,PatFinder identified commits from numerous vulnerability-related references.Then,PatFinder selected patches based on code changes of identified commits and a weighted voting mechanism.Finally,based on designed patch parsing methods,metadata of patches(i.e.,paths of modified files and names of functions)was obtained.Our experiment has shown that PatFinder can achieve a coverage of 73.10%and a recall of 0.802,significantly improving the coverage and recall of existing approaches.
作者
许聪颖
陈碧欢
赵文耘
Xu Congying;Chen Bihuan;Zhao Wenyun(Software School,Fudan University,Shanghai 200438,China;Shanghai Key Laboratory of Data Science,Shanghai 200438,China)
出处
《计算机应用与软件》
北大核心
2025年第4期1-7,32,共8页
Computer Applications and Software
基金
国家自然科学基金项目(61802067)。
关键词
软件安全
漏洞
补丁
Software security
Vulnerability
Patch
