Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation

TL;DR

This paper introduces an explainable AI framework using encoder-decoder models to predict silent dependency vulnerabilities in open-source software, providing detailed key aspects to improve trust and usability.

Contribution

It presents the first application of Explainable AI for silent dependency alert prediction, utilizing CodeBERT to generate detailed vulnerability explanations.

Findings

CodeBERT with commit messages and code changes performs best.

Explainable predictions help users identify silent dependency alerts more easily.

The framework enhances trustworthiness and user acceptance of vulnerability alerts.

Abstract

Due to convenience, open-source software is widely used. For beneficial reasons, open-source maintainers often fix the vulnerabilities silently, exposing their users unaware of the updates to threats. Previous works all focus on black-box binary detection of the silent dependency alerts that suffer from high false-positive rates. Open-source software users need to analyze and explain AI prediction themselves. Explainable AI becomes remarkable as a complementary of black-box AI models, providing details in various forms to explain AI decisions. Noticing there is still no technique that can discover silent dependency alert on time, in this work, we propose a framework using an encoder-decoder model with a binary detector to provide explainable silent dependency alert prediction. Our model generates 4 types of vulnerability key aspects including vulnerability type, root cause, attack vector, and impact to enhance the trustworthiness and users' acceptance to alert prediction. By experiments with several models and inputs, we confirm CodeBERT with both commit messages and code changes achieves the best results. Our user study shows that explainable alert predictions can help users find silent dependency alert more easily than black-box predictions. To the best of our knowledge, this is the first research work on the application of Explainable AI in silent dependency alert prediction, which opens the door of the related domains.