VulCurator: A Vulnerability-Fixing Commit Detector

TL;DR

VulCurator is a deep learning-based tool that effectively detects vulnerability-fixing commits in open-source software by utilizing diverse information sources, significantly outperforming previous methods.

Contribution

It introduces VulCurator, a novel deep learning approach that combines commit messages, code changes, and issue reports for improved vulnerability-fixing commit detection.

Findings

VulCurator outperforms state-of-the-art baselines by up to 16.1% in F1-score.

Utilizes richer information sources than previous models.

Demonstrates effectiveness of deep learning on multiple data types.

Abstract

Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, including commit messages, code changes and issue reports for vulnerability-fixing commit classifica- tion. Our experimental results show that VulCurator outperforms the state-of-the-art baselines up to 16.1% in terms of F1-score. VulCurator tool is publicly available at https://github.com/ntgiang71096/VFDetector and https://zenodo.org/record/7034132#.Yw3MN-xBzDI, with a demo video at https://youtu.be/uMlFmWSJYOE.