AIBugHunter: A Practical Tool for Predicting, Classifying and Repairing Software Vulnerabilities
Many Machine Learning(ML)-based approaches have been proposed to automatically detect, localize, and repair software vulnerabilities. While ML-based methods are more effective than program analysis-based vulnerability analysis tools, few have been integrated into modern Integrated Development Environments (IDEs), hindering practical adoption. To bridge this critical gap, we propose in this article AIBUGHUNTER, a novel Machine Learning-based software vulnerability analysis tool for C/C++ languages that is integrated into the Visual Studio Code (VS Code) IDE. AIBUGHUNTER helps software developers to achieve real-time vulnerability detection, explanation, and repairs during programming. In particular, AIBUGHUNTER scans through developers’ source code to (1) locate vulnerabilities, (2) identify vulnerability types, (3) estimate vulnerability severity, and (4) suggest vulnerability repairs. We integrate our previous works (i.e., LineVul and VulRepair) to achieve vulnerability localization and repairs. In this article, we propose a novel multi-objective optimization (MOO)-based vulnerability classification approach and a transformer-based estimation approach to help AIBUGHUNTER accurately identify vulnerability types and estimate severity. Our empirical experiments on a large dataset consisting of 188K+ C/C++ functions confirm that our proposed approaches are more accurate than other state-of-the-art baseline methods for vulnerability classification and estimation. Furthermore, we conduct qualitative evaluations including a survey study and a user study to obtain software practitioners’ perceptions of our AIBUGHUNTER tool and assess the impact that AIBUGHUNTER may have on developers’ productivity in security aspects. Our survey study shows that our AIBUGHUNTER is perceived as useful where 90% of the participants consider adopting our AIBUGHUNTER during their software development. Last but not least, our user study shows that our AIBUGHUNTER can enhance developers’ productivity in combating cybersecurity issues during software development. AIBUGHUNTER is now publicly available in the Visual Studio Code marketplace.
Wed 17 AprDisplayed time zone: Lisbon change
14:00 - 15:30 | Program Repair 2Journal-first Papers / Research Track / Software Engineering in Practice at Pequeno Auditório Chair(s): Xiang Gao Beihang University | ||
14:00 15mTalk | Practical Program Repair via Preference-based Ensemble Strategy Research Track Wenkang Zhong State Key Laboratory for Novel Software and Technology, Nanjing University, 22 Hankou Road, Nanjing, China, Chuanyi Li Nanjing University, Kui Liu Huawei, Tongtong Xu Huawei, Jidong Ge Nanjing University, Tegawendé F. Bissyandé University of Luxembourg, Bin Luo Nanjing University, Vincent Ng Human Language Technology Research Institute, University of Texas at Dallas, Richardson, TX 75083-0688 | ||
14:15 15mTalk | Learning and Repair of Deep Reinforcement Learning Policies from Fuzz-Testing Data Research Track Martin Tappler TU Graz; Silicon Austria Labs, Andrea Pferscher Institute of Software Technology, Graz University of Technology , Bernhard Aichernig Graz University of Technology, Bettina Könighofer Graz University of Technology | ||
14:30 15mTalk | BinAug: Enhancing Binary Similarity Analysis with Low-Cost Input Repairing Research Track WONG Wai Kin Hong Kong University of Science and Technology, Huaijin Wang Hong Kong University of Science and Technology, Li Zongjie Hong Kong University of Science and Technology, Shuai Wang The Hong Kong University of Science and Technology | ||
14:45 15mTalk | Constraint Based Program Repair for Persistent Memory Bugs Research Track | ||
15:00 15mTalk | User-Centric Deployment of Automated Program Repair at Bloomberg Software Engineering in Practice David Williams University College London, James Callan UCL, Serkan Kirbas Bloomberg LP, Sergey Mechtaev University College London, Justyna Petke University College London, Thomas Prideaux-Ghee Bloomberg LP, Federica Sarro University College London | ||
15:15 7mTalk | AIBugHunter: A Practical Tool for Predicting, Classifying and Repairing Software Vulnerabilities Journal-first Papers Michael Fu Monash University, Kla Tantithamthavorn Monash University, Trung Le Monash University, Australia, Yuki Kume Monash University, Van Nguyen Monash University, Dinh Phung Monash University, Australia, John Grundy Monash University Link to publication DOI Pre-print | ||