VulCurator: A Vulnerability-Fixing Commit Detector
Truong Giang Nguyen, Thanh Le-Cong, Hong Jin Kang, Xuan-Bach D. Le,, David Lo

TL;DR
VulCurator is a deep learning-based tool that effectively detects vulnerability-fixing commits in open-source software by utilizing diverse information sources, significantly outperforming previous methods.
Contribution
It introduces VulCurator, a novel deep learning approach that combines commit messages, code changes, and issue reports for improved vulnerability-fixing commit detection.
Findings
VulCurator outperforms state-of-the-art baselines by up to 16.1% in F1-score.
Utilizes richer information sources than previous models.
Demonstrates effectiveness of deep learning on multiple data types.
Abstract
Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, including commit messages, code changes and issue reports for vulnerability-fixing commit classifica- tion. Our experimental results show that VulCurator…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Web Application Security Vulnerabilities · Software Engineering Research
