PatUntrack: Automated Generating Patch Examples for Issue Reports without Tracked Insecure Code
Ziyou Jiang, Lin Shi, Guowei Yang, Qing Wang

TL;DR
PatUntrack automatically generates patch examples for issue reports lacking tracked insecure code by leveraging large language models and external knowledge, aiding security developers in vulnerability patching.
Contribution
It introduces an automated approach using LLMs to generate patch examples from IRs without explicit insecure code, improving patch generation effectiveness.
Findings
Achieved +14.6% improvement in patch example generation over baselines.
Generated useful patch examples for 76 new IRs, confirmed by IR authors.
Demonstrated practical benefit for security patching processes.
Abstract
Security patches are essential for enhancing the stability and robustness of projects in the software community. While vulnerabilities are officially expected to be patched before being disclosed, patching vulnerabilities is complicated and remains a struggle for many organizations. To patch vulnerabilities, security practitioners typically track vulnerable issue reports (IRs), and analyze their relevant insecure code to generate potential patches. However, the relevant insecure code may not be explicitly specified and practitioners cannot track the insecure code in the repositories, thus limiting their ability to generate patches. In such cases, providing examples of insecure code and the corresponding patches would benefit the security developers to better locate and fix the insecure code. In this paper, we propose PatUntrack to automatically generating patch examples from IRs without…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsScientific Computing and Data Management · Research Data Management Practices
MethodsActivation Patching
