Out of Sight, Out of Mind: Better Automatic Vulnerability Repair by Broadening Input Ranges and Sources
The advances of deep learning (DL) have paved the way for automatic software vulnerability repair approaches, which effectively learn the mapping from the vulnerable code to the fixed code. Nevertheless, existing DL-based vulnerability repair methods face notable limitations: 1) they struggle to handle lengthy vulnerable code, 2) they treat code as natural language texts, neglecting its inherent structure, and 3) they do not tap into the valuable expert knowledge present in the expert system. To address this, we propose VulMaster, a Transformer-based neural network model that excels at generating vulnerability repairs by comprehensively understanding the entire vulnerable code, irrespective of its length. This model also integrates diverse information, encompassing vulnerable code structures and expert knowledge from the CWE system. We evaluated VulMaster on a real-world C/C++ vulnerability repair dataset comprising 1,754 projects with 5,800 vulnerable functions. The experimental results demonstrated that VulMaster exhibits substantial improvements compared to the learning-based state-of-the-art vulnerability repair approach. Specifically, VulMaster improves the EM, BLEU, and CodeBLEU scores from 10.2% to 20.3%, 19.0% to 26.6%, and 32.6% to 40.0%, respectively.
Wed 17 AprDisplayed time zone: Lisbon change
16:00 - 17:30 | |||
16:00 15mTalk | RUNNER: Responsible UNfair NEuron Repair for Enhancing Deep Neural Network Fairness Research Track Li Tianlin Nanyang Technological University, Yue Cao Nanyang Technological University, Jian Zhang Nanyang Technological University, Shiqian Zhao Nanyang Technological University, Yihao Huang East China Normal University, Aishan Liu Beihang University; Institute of Dataspace, Qing Guo IHPC and CFAR at A*STAR, Singapore, Yang Liu Nanyang Technological University | ||
16:15 15mTalk | ITER: Iterative Neural Repair for Multi-Location Patches Research Track | ||
16:30 15mTalk | Out of Context: How important is Local Context in Neural Program Repair? Research Track | ||
16:45 15mTalk | Out of Sight, Out of Mind: Better Automatic Vulnerability Repair by Broadening Input Ranges and Sources Research Track Xin Zhou Singapore Management University, Singapore, Kisub Kim Singapore Management University, Singapore, Bowen Xu North Carolina State University, DongGyun Han Royal Holloway, University of London, David Lo Singapore Management University | ||
17:00 15mTalk | Strengthening Supply Chain Security with Fine-grained Safe Patch Identification Research Track Luo Changhua The Chinese University of Hong Kong, Wei Meng Chinese University of Hong Kong, Shuai Wang The Hong Kong University of Science and Technology |