To address security vulnerabilities arising from third-party libraries, security researchers maintain databases monitoring and curating vulnerability reports. Application developers can identify vulnerable libraries by directly querying the databases with their used libraries. However, the querying results of vulnerable libraries are not reliable due to the incompleteness of vulnerability reports. Thus, current approaches model the task of identifying vulnerable libraries as a named-entity-recognition (NER) task or an extreme multi-label learning (XML) task. These approaches suffer from highly inaccurate results in identifying vulnerable libraries with complex and similar names, e.g., Java libraries. To address these limitations, in this paper, we propose VulLibMiner, the first to identify vulnerable libraries from textual descriptions of both vulnerabilities and libraries, together with VulLib, a Java vulnerability dataset with their affected libraries. VulLibMiner consists of a TF-IDF matcher to efficiently screen out a small set of candidate libraries and a BERT-FNN model to identify vulnerable libraries from these candidates effectively. We evaluate VulLibMiner using four state-of-the-art/practice approaches of identifying vulnerable libraries on both their dataset named VeraJava and our VulLib dataset. Our evaluation results show that VulLibMiner can effectively identify vulnerable libraries with an average F1 score of 0.657 while the state-of-the-art/practice approaches achieve only 0.521.

翻译：为应对第三方库引发的安全漏洞，安全研究人员维护着监控和整理漏洞报告的数据库。应用开发者可通过直接查询数据库来识别其使用的库是否存在漏洞。然而，由于漏洞报告的不完整性，基于查询的漏洞库识别结果并不可靠。现有方法将漏洞库识别任务建模为命名实体识别（NER）或极端多标签学习（XML）任务，但这些方法在处理名称复杂且相似的库（如Java库）时存在结果准确性严重不足的问题。针对上述局限，本文提出VulLibMiner——首个通过漏洞与库的文本描述来识别漏洞库的方法，同时贡献了包含受影响库的Java漏洞数据集VulLib。VulLibMiner包含TF-IDF匹配器（用于高效筛选少量候选库）和BERT-FNN模型（用于从候选库中有效识别漏洞库）。我们采用四种当前最先进/最优实践的漏洞库识别方法，在VeraJava数据集与VulLib数据集上对VulLibMiner进行评测。评估结果表明，VulLibMiner能有效识别漏洞库，其平均F1分数达0.657，而现有最优方法仅达0.521。