The growing dependence of software projects on external libraries has generated apprehensions regarding the security of these libraries because of concealed vulnerabilities. Handling these vulnerabilities presents difficulties due to the temporal delay between remediation and public exposure. Furthermore, a substantial fraction of open-source projects covertly address vulnerabilities without any formal notification, influencing vulnerability management. Established solutions like OWASP predominantly hinge on public announcements, limiting their efficacy in uncovering undisclosed vulnerabilities. To address this challenge, the automated identification of vulnerability-fixing commits has come to the forefront. In this paper, we present VFFINDER, a novel graph-based approach for automated silent vulnerability fix identification. VFFINDER captures structural changes using Abstract Syntax Trees (ASTs) and represents them in annotated ASTs. To precisely capture the meaning of code changes, the changed code is represented in connection with the related unchanged code. In VFFINDER, the structure of the changed code and related unchanged code are captured and the structural changes are represented in annotated Abstract Syntax Trees (aAST). VFFINDER distinguishes vulnerability-fixing commits from non-fixing ones using attention-based graph neural network models to extract structural features expressed in aASTs. We conducted experiments to evaluate VFFINDER on a dataset of 11K+ vulnerability fixing commits in 507 real-world C/C++ projects. Our results show that VFFINDER significantly improves the state-of-the-art methods by 272-420% in Precision, 22-70% in Recall, and 3.2X-8.2X in F1. Especially, VFFINDER speeds up the silent fix identification process by up to 121% with the same effort reviewing 50K LOC compared to the existing approaches.

翻译：软件项目对外部库的日益依赖引发了对这些库安全性的担忧，原因在于隐藏漏洞的存在。由于修复与公开暴露之间存在时间延迟，处理这些漏洞面临诸多挑战。此外，相当一部分开源项目在未进行任何正式通知的情况下秘密修复漏洞，从而影响了漏洞管理。诸如OWASP等现有解决方案主要依赖公开公告，其在发现未公开漏洞方面的有效性受限。为应对这一挑战，漏洞修复提交的自动识别问题应运而生。本文提出了VFFINDER——一种基于图的新方法，用于自动识别静默漏洞修复。VFFINDER利用抽象语法树（AST）捕获结构变更，并将其表示在带注释的抽象语法树（aAST）中。为精准捕捉代码变更的语义，变更代码与相关未变更代码进行关联表示。在VFFINDER中，变更代码及相关未变更代码的结构被捕获，结构变更以带注释的抽象语法树（aAST）形式表示。VFFINDER采用基于注意力机制的图神经网络模型提取aAST中的结构特征，从而区分漏洞修复提交与非修复提交。我们在包含507个真实C/C++项目中超过11,000个漏洞修复提交的数据集上进行了实验评估。结果表明，VFFINDER在精确率、召回率和F1分数上分别比现有最优方法提升了272%-420%、22%-70%及3.2倍-8.2倍。值得注意的是，在审查5万行代码（LOC）的同等工作量下，VFFINDER将静默修复识别速度最高提升了121%。