Enhancing security patch identification by capturing structures in commits

Author

Bozhi WU
Shangqing LIU
Ruitao FENG
Xiaofei XIE, Singapore Management UniversityFollow
Jingkai SIOW
Shang-Wei LIN

Publication Type

Journal Article

Version

acceptedVersion

Publication Date

7-2022

Abstract

With the rapid increasing number of open source software (OSS), the majority of the software vulnerabilities in the open source components are fixed silently, which leads to the deployed software that integrated them being unable to get a timely update. Hence, it is critical to design a security patch identification system to ensure the security of the utilized software. However, most of the existing works for security patch identification just consider the changed code and the commit message of a commit as a flat sequence of tokens with simple neural networks to learn its semantics, while the structure information is ignored. To address these limitations, in this paper, we propose our well-designed approach E-SPI, which extracts the structure information hidden in a commit for effective identification. Specifically, it consists of the code change encoder to extract the syntactic of the changed code with the BiLSTM to learn the code representation and the message encoder to construct the dependency graph for the commit message with the graph neural network (GNN) to learn the message representation. We further enhance the code change encoder by embedding contextual information related to the changed code. To demonstrate the effectiveness of our approach, we conduct the extensive experiments against six state-of-the-art approaches on the existing dataset and from the real deployment environment. The experimental results confirm that our approach can significantly outperform current state-of-the-art baselines.

Keywords

Security Patch Identification, Graph Neural Networks, Abstract Syntax Tree

Discipline

Graphics and Human Computer Interfaces | Information Security | OS and Networks

Research Areas

Intelligent Systems and Optimization

Publication

IEEE Transactions on Dependable and Secure Computing

First Page

1

Last Page

15

ISSN

1545-5971

Identifier

10.1109/TDSC.2022.3192631

Publisher

Institute of Electrical and Electronics Engineers

Citation

WU, Bozhi; LIU, Shangqing; FENG, Ruitao; XIE, Xiaofei; SIOW, Jingkai; and LIN, Shang-Wei. Enhancing security patch identification by capturing structures in commits. (2022). IEEE Transactions on Dependable and Secure Computing. 1-15.
Available at: https://ink.library.smu.edu.sg/sis_research/7500

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.

Additional URL

https://doi.org/10.1109/TDSC.2022.3192631