An automatic positioning security patch method fusing multi-dimensional features

Abstract

This invention provides a method for automatically locating security patches by integrating multi-dimensional features. The technical solution includes the following steps: S1: Collecting vulnerability and code submission datasets from GitHub, CVE, and NVD libraries and performing preprocessing operations; S2: Extracting expert feature values ​​from vulnerability descriptions using the GumTree tool; S3: Extracting deep semantic feature values ​​from vulnerability descriptions and submission information using a T5 pre-trained model, and further processing the semantic vector values ​​using BERT-whitening, performing key feature extraction and dimensionality reduction through linear transformation; S4: Randomly dividing the constructed dataset into training, validation, and test sets; S5: Predicting the final result using a decision tree model. The beneficial effects of this invention are: extracting richer features from the dataset, thereby improving the quality and reliability of security patch location.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method for automatically locating security patches by integrating multi-dimensional features. Background Technology

[0002] Security patches play a crucial role in defending against the growing security threats posed by vulnerabilities in open-source software. However, collecting security patches remains a challenging problem. Most existing research employs a matching-based design, utilizing auxiliary information from CVE / NVD to narrow down the search for patch submissions.

[0003] However, accurately obtaining security patches is crucial, and currently quite challenging. Its importance lies in several aspects: First, developers can directly apply patches to fix appropriate vulnerabilities. Second, patches help estimate the impact of vulnerabilities and develop plans to mitigate their risks in a timely manner. Third, developers can analyze the characteristics of vulnerabilities based on their patches and learn how to remediate or prevent similar problems. Furthermore, a large number of vulnerability patches have been collected to facilitate vulnerability-related research, such as vulnerability prediction, vulnerability code cloning detection, and vulnerability testing.

[0004] How to solve the above-mentioned technical problems is the challenge facing this invention. Summary of the Invention

[0005] The purpose of this invention is to provide a method for automatically locating security patches by integrating multi-dimensional features. This method can automatically locate vulnerabilities in open-source software.

[0006] The core idea of ​​this invention is as follows: This invention proposes an automatic security patch location method that integrates multi-dimensional features. Specifically, it extracts deep semantic features from vulnerability descriptions and submission information using a pre-trained model, Transfer Text-to-Text Transformer, and extracts expert features from vulnerability descriptions using the GumTree tool. BERT-whitening is used to process the deep semantic vectors, and key features are extracted and dimensionality reduced through linear transformation. Then, the SMOTE method is used to handle class imbalance, and finally, a decision tree model is used for training and validation, thereby more accurately locating security patches for vulnerabilities in open-source software.

[0007] This invention is achieved through the following measures: an automatic security patch location method that integrates multi-dimensional features, comprising the following steps:

[0008] Step 1.1: Collect vulnerability information and code commit information of the required open source projects by using web crawlers in GitHub, CVE and NVD repositories;

[0009] Step 1.2: Use the pre-trained Transfer Text-to-Text Transformer (abbreviated as T5) model to extract the deep semantic feature values of the vulnerability description and commit information, and use BERT-whitening to process the semantic vectors, and perform key feature extraction and dimensionality reduction through linear transformation; use the GumTree tool to extract the expert feature values of the vulnerability description;

[0010] Step 1.3: The datasets used for deep semantic extraction are the commit information and vulnerability descriptions in CVE. Set the dataset related to commit information as D1, and the format of D1 is <CVE identifier, project name, commit information>. Set the dataset related to vulnerability description as D2, and the format of D2 is <CVE identifier, description information>. Connect the extracted deep semantic feature values and expert feature values to obtain dataset D3, and set the format of dataset D3 as <project name, deep semantic feature values of vulnerability description and commit information, expert feature values of vulnerability description>;

[0011] Step 1.4: Use the SMOTE method to process the class imbalance of the dataset D3 constructed in Step 1.3 to obtain the processed dataset D;

[0012] Step 1.5: Divide the dataset D processed in Step 1.4, randomly divide it into training dataset and test dataset according to the ratio of 80%:20%, and use the training dataset to construct a decision tree classifier and the test dataset to test the classifier;

[0013] Step 1.6: Use the Decision Tree model to make the final prediction to obtain the final solution to the problem, so as to locate the security patch.

[0014] To implement a further optimization scheme of the automatic security patch location method integrating multi-dimensional features of the present invention, the extraction of the deep semantic feature values of the vulnerability description and commit information and the extraction of the expert feature values of the vulnerability description in Step 1.2 specifically include the following steps:

[0015] Step 2.1: For the given vulnerability description and code commit, perform data preprocessing on them according to the stop words in the stop word library to obtain the input sequence X;

[0016] Step 2.2: Input the input sequence X into the pre-trained Transfer Text-to-Text Transformer model, extract the hidden states of the first layer and the last layer in the output model, and take their average value to obtain the deep semantic feature vector V of the vulnerability description and code commit T5 , ,

[0017] , ,

[0016] ,

[0015] ;

[0017] Step 2.3: Use BERT-whitening to process the deep semantic feature vector V T5 By performing key feature extraction and dimensionality reduction through linear transformation, the processed deep semantic feature vector V is obtained. pro ;

[0018] Step 2.4: Design 32 expert features from four perspectives: vulnerability identifier, vulnerability type, attacker information, and vulnerability location. Use the GumTree tool to extract the values ​​of these 32 expert features from code submissions and form an expert feature value vector V. h ;

[0019] Step 2.5: After obtaining the values ​​of the expert feature vector and the semantic feature vector, we concatenate these two vectors to construct the vector representation V.

[0020] To further optimize the automatic localization security patching method that integrates multi-dimensional features according to the present invention, step 1.4 uses the SMOTE method to handle class imbalance and uses the balanced data to construct a decision tree classifier, which can improve the accuracy of the model.

[0021] To further optimize the automatic location security patching method integrating multi-dimensional features of the present invention, step 1.5 uses a decision tree model to train on the training set and form a corresponding vector representation, specifically including the following steps:

[0022] Step 4.1: Divide the balanced dataset D obtained in Step 1.3 into training and test datasets by randomly dividing it into two groups with a ratio of 80%:20%.

[0023] Step 4.2: Use the text description information of the vulnerability and the corresponding fix submission as positive samples, and randomly select twice the number of other submissions from the code repository as negative samples for training;

[0024] Step 4.3: Based on the decision tree classifier, determine the encoding method of each candidate solution, predict the location of the security patch corresponding to the vulnerability, and return the result, denoted as Pred.

[0025] As a further optimization of the automatic localization security patching method that integrates multi-dimensional features provided by the present invention, step 1.2 uses BERT-whitening from machine learning to further process the semantic vector, that is, to extract key features and reduce the dimensionality of the semantic vector extracted by the T5 model through linear transformation, thereby reducing storage space and greatly improving the training speed of the model.

[0026] Compared with existing technologies, the beneficial effects of this invention are as follows: The automatic location security patching method proposed in this invention, which integrates multi-dimensional features, not only considers traditional expert feature information but also incorporates a T5 model for deep semantic feature information extraction. To make the location results more accurate, the SMOTE algorithm is used to first handle class imbalance, and then a decision tree model is used for training and validation. Compared with the previous model that simply uses information matching, adding an additional deep feature extraction model can better characterize the semantic information of vulnerability descriptions and code submissions, making the final prediction results more accurate and reliable. Attached Figure Description

[0027] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0028] Figure 1 This invention provides a system framework diagram for an automatic location security patch method that integrates multi-dimensional features. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Of course, the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0030] Example 1

[0031] See Figure 1 As shown, this embodiment provides a method for automatically locating security patches by fusing multi-dimensional features, specifically including the following steps:

[0032] Step (1-1) Collect vulnerability information and code commit information of the required open source projects by using web crawlers in GitHub, CVE and NVD libraries;

[0033] Steps (1-2) use the Transfer Text-to-Text Transformer (T5) pre-trained model to extract deep semantic feature values ​​of vulnerability description and submission information, and use BERT-whitening to process semantic vectors, performing key feature extraction and dimensionality reduction through linear transformation; use the GumTree tool to extract expert feature values ​​of vulnerability description.

[0034] For the deep semantic extraction in step (1-3), the datasets used are the submission information and vulnerability descriptions in CVE. Set the dataset related to the submission information as D1, and the format of D1 is <CVE identifier, project name, submission information>. Set the dataset related to the vulnerability description as D2, and the format of D2 is <CVE identifier, description information>. Connect the extracted deep semantic feature values and expert feature values to obtain dataset D3, and set the format of dataset D3 as <project name, deep semantic feature values of the vulnerability description and submission information, expert feature values of the vulnerability description>;

[0035] In step (1-4), use the SMOTE method to process the class imbalance of the dataset D3 constructed in step 1.3 to obtain dataset D;

[0036] In step (1-5), divide the dataset D after being processed in step 1.4, randomly divide it into a training dataset and a test dataset according to the ratio of 80%:20%, and use the training dataset to construct a decision tree classifier and the test dataset to test the classifier;

[0037] In step (1-6), use the Decision Tree model to make the final prediction to obtain the final solution to the problem, and use this to locate the security patch.

[0038] The extraction of the deep semantic feature values of the vulnerability description and submission information and the extraction of the expert feature values of the vulnerability description in step (1-2) specifically include the following steps:

[0039] In step (2-1), for the given vulnerability description and code submission, perform data preprocessing on them according to the stop words in the stop word library to obtain the input sequence X;

[0040] In step (2-2), input the input sequence X into the pre-trained Transfer Text-to-Text Transformer model, extract the hidden states of the first layer and the last layer in the output model, and take the average of them to obtain the deep semantic feature vector V of the vulnerability description and code submission T5 ;

[0041] In step (2-3), use BERT-whitening to process the deep semantic feature vector V T5 , perform key feature extraction and dimensionality reduction through linear transformation to obtain the processed deep semantic feature vector V pro ;

[0042] In step (2-4), design 32 expert features from the four perspectives of vulnerability identifier, vulnerability type, attacker information, and vulnerability location, and use the GumTree tool to extract the values of these 32 expert features from the code submission and form an expert feature value vector Vh ;

[0043] Step (2-5): After obtaining the values ​​of the expert feature vector and the semantic feature vector, we concatenate these two vectors to construct the vector representation V.

[0044] In steps (1-4), the SMOTE method is used to handle class imbalance. The balanced data is then used to build a decision tree classifier, which can improve the accuracy of the model.

[0045] Steps (1-5) involve training a decision tree model on the training set to generate corresponding vector representations, specifically including the following steps:

[0046] Step (4-1) divides the balanced dataset D obtained in step (1-3) into training and test datasets in a ratio of 80%:20%.

[0047] Step (4-2) uses the text description information of the vulnerability and the corresponding fix submission as positive samples, and randomly selects twice the number of other submissions from the code repository as negative samples for training;

[0048] Step (4-3) uses a decision tree classifier to determine the encoding method of each candidate solution and predicts the location of the security patch corresponding to the vulnerability. The result is returned and denoted as Pred.

[0049] Step (5) evaluates the method of this embodiment and existing localization methods on the same dataset, automatically assessing the quality of the model using two performance metrics from the security patch localization research field: Recall and Manual Efforts. For Manual Efforts, for M1, M2, and M3, since they are match-based rather than ranking-based, all matching submissions have the same priority to the user. Because all matching submissions require manual verification, we use the number of matching submissions to measure the human effort involved. When using this method and M4, the user examines each sorted code submission to find the patch submission. Therefore, we use the number of submissions that need to be manually checked before finding the patch submission to calculate the required human effort.

[0050] Table 4 Comparison of Results between the Method in This Embodiment and Other Methods

[0051]

[0052] Experiments show that the proposed automatic security patch location method, which integrates multi-dimensional features, achieves higher reliability in defect prediction compared to baseline methods. Specifically, the method in this embodiment integrates deep semantic features of vulnerability descriptions and submission information, as well as expert features of vulnerability descriptions, surpassing these baseline methods. Specifically, for recall, the method in this embodiment improves performance by at least 11.39%; for manual efforts, the method in this embodiment also significantly reduces the required manual effort. These results demonstrate the competitiveness of the proposed method.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for automatically locating security patches by integrating multi-dimensional features, characterized in that, It includes the following steps: Step 1.1: Collect vulnerability information and code submission information of the required open-source projects from the GitHub, CVE, and NVD libraries; Step 1.2: Use the pre-trained Transfer Text-to-Text Transformer model to extract the deep semantic feature values of the vulnerability description and submission information, and use BERT-whitening to process the semantic vectors. Key feature extraction and dimensionality reduction are performed through linear transformation; use the GumTree tool to extract the expert feature values of the vulnerability description; Step 1.3: The datasets used for deep semantic extraction are the submission information and vulnerability descriptions in CVE. Set the dataset related to submission information as D1, and the format of D1 is <CVE identifier, project name, submission information>. Set the dataset related to vulnerability description as D2, and the format of D2 is <CVE identifier, description information>; Connect the extracted deep semantic feature values and expert feature values to obtain dataset D3. Set the format of dataset D3 as <project name, deep semantic feature values of vulnerability description and submission information, expert feature values of vulnerability description>; Step 1.4: Use the SMOTE method to process the class imbalance of the dataset D3 constructed in Step 1.3 to obtain the processed dataset D; Step 1.5: Divide the dataset D processed in Step 1.4, and randomly divide it into training dataset and test dataset according to the ratio of 80%:20%. Then use the training dataset to construct a decision tree classifier and use the test dataset to test the classifier; Step 1.6: Use the decision tree model for the final prediction to obtain the final solution to the problem, and use this to locate the security patch.

2. The automatic location security patching method integrating multi-dimensional features according to claim 1, characterized in that, The extraction of the deep semantic feature values of the vulnerability description and submission information and the extraction of the expert feature values of the vulnerability description in Step 1.2 specifically include the following steps: Step 2.1: For the given vulnerability description and code submission, perform data preprocessing on them according to the stop words in the stop word library to obtain the input sequence X; Step 2.2: Input the input sequence X into the Transfer Text-to-Text Transformer pre-trained model, extract the hidden states of the first and last layers of the output model, and average them to obtain the deep semantic feature vector V of the vulnerability description and code submission. T5 ; Step 2.3: Use BERT-whitening to process the deep semantic feature vector V T5 By performing key feature extraction and dimensionality reduction through linear transformation, the processed deep semantic feature vector V is obtained. pro ; Step 2.4: Design 32 expert features from four perspectives: vulnerability identifier, vulnerability type, attacker information, and vulnerability location. Use the GumTree tool to extract the values ​​of these 32 expert features from code submissions and form an expert feature value vector V. h ; Step 2.5: After obtaining the expert feature value vector and semantic feature vector, connect these two vectors to construct the vector representation V.

3. The automatic location security patching method integrating multi-dimensional features according to claim 1, characterized in that, The use of the decision tree model to train on the training dataset and form the corresponding vector representation in Step 1.5 specifically includes the following steps: [[ID= ​ ​

Images