With the increasing reliance on Open Source Software, users are exposed to third-party library vulnerabilities. Software Composition Analysis (SCA) tools have been created to alert users of such vulnerabilities. SCA requires the identification of vulnerability-fixing commits. Prior works have proposed methods that can automatically identify such vulnerability-fixing commits. However, identifying such commits is highly challenging, as only a very small minority of commits are vulnerability fixing. Moreover, code changes can be noisy and difficult to analyze. We observe that noise can occur at different levels of detail, making it challenging to detect vulnerability fixes accurately. To address these challenges and boost the effectiveness of prior works, we propose MiDas (Multi-Granularity Detector for Vulnerability Fixes). Unique from prior works, Midas constructs different neural networks for each level of code change granularity, corresponding to commit-level, file-level, hunk-level, and line-level, following their natural organization. It then utilizes an ensemble model that combines all base models to generate the final prediction. This design allows MiDas to better handle the noisy and highly imbalanced nature of vulnerability-fixing commit data. Additionally, to reduce the human effort required to inspect code changes, we have designed an effort-aware adjustment for Midas's outputs based on commit length. The evaluation results demonstrate that MiDas outperforms the current state-of-the-art baseline in terms of AUC by 4.9% and 13.7% on Java and Python-based datasets, respectively. Furthermore, in terms of two effort-aware metrics, EffortCost@L and Popt@L, MiDas also outperforms the state-of-the-art baseline, achieving improvements of up to 28.2% and 15.9% on Java, and 60% and 51.4% on Python, respectively.

翻译：随着对开源软件依赖程度的增加，用户面临第三方库漏洞的风险。软件组成分析（SCA）工具应运而生，用于向用户警示此类漏洞。SCA需要识别修复漏洞的提交。已有研究提出了自动识别此类漏洞修复提交的方法。然而，由于仅极少数提交涉及漏洞修复，识别这类提交极具挑战性。此外，代码变更可能包含噪声且难以分析。我们观察到噪声可能出现在不同细节层级，导致精确检测漏洞修复变得困难。为解决这些挑战并提升现有方法的有效性，我们提出MiDas（多粒度漏洞修复检测器）。与现有研究不同，MiDas遵循代码变更的自然组织层级，分别为提交级、文件级、代码块级和行级构建不同的神经网络。随后采用集成模型融合所有基模型生成最终预测。这种设计使MiDas能更好地处理漏洞修复提交数据中的噪声严重和高度不平衡特性。此外，为减少人工审查代码变更的负担，我们基于提交长度设计了注重人力成本的MiDas输出调整机制。评估结果表明，在Java和Python数据集上，MiDas的AUC指标分别比当前最优基线方法提升4.9%和13.7%。在两种注重人力成本的指标EffortCost@L和Popt@L上，MiDas同样超越最优基线，在Java上分别提升28.2%和15.9%，在Python上分别提升60%和51.4%。