Investigating the Consistency of Vulnerability Remediation

We are investigating the consistency of vulnerability remediation within CWE categories.

Project idea

We will create a dataflow pipeline that takes a list of pairs: (vulnerability remediating github commit + CVE ID) and outputs an AST edit script where the structural changes done in the commit. This work will provide a stepping stone for researchers who want to understand the structural changes involved in vulnerability remediation.

Papers

Here are three papers that inform our investigation:

@inproceedings{bosu_identifying_2014,
  author    = {Bosu, Amiangshu and Carver, Jeffrey C. and Hafiz, Munawar and Hilley, Patrick and Janni, Derek},
  title     = {Identifying the characteristics of vulnerable code changes: an empirical study},
  booktitle = FSE,
  year      = {2014},
  pages     = {257--268},
  doi       = {10.1145/2635868.2635880}
}

@article{canfora_patchworking_2022,
  author    = {Canfora, Gerardo and Di Sorbo, Andrea and Forootani, Sara and Martinez, Matias and Visaggio, Corrado A.},
  title     = {Patchworking: {Exploring} the code changes induced by vulnerability fixing activities},
  journal   = IST,
  year      = {2022},
  volume    = {142},
  pages     = {106745},
  doi       = {10.1016/j.infsof.2021.106745}
}

@inproceedings{piantadosi_fixing_2019,
    author    = {Piantadosi, Valentina and Scalabrino, Simone and Oliveto, Rocco},
    title     = {Fixing of {Security} {Vulnerabilities} in {Open} {Source} {Projects}: {A} {Case} {Study} of {Apache} {HTTP} {Server} and {Apache} {Tomcat}},
    booktitle = {2019 12th {IEEE} {Conference} on {Software} {Testing}, {Validation} and {Verification} ({ICST})},
    year      = {2019},
    pages     = {68--78},
    month     = apr,
    doi       = {10.1109/ICST.2019.00017},
    issn      = {2159-4848},
    url       = {https://ieeexplore.ieee.org/document/8730158}
}

Group Members

The group members are:

• Sample Student