VulLoc:vulnerability localization based on inducing commits and fixing commits  

作　　者：Lili BO Yue LI Xiaobing SUN Xiaoxue WU Bin LI 

机构地区：[1]School of Information Engineering,Yangzhou University,Yangzhou 225127,China [2]Key Laboratory of Safety-Critical Software,Ministry of Industry and Information Technology,Nanjing University of Aeronautics and Astronautics,Nanjing 211106,China

出　　处：《Frontiers of Computer Science》2023年第3期243-245,共3页中国计算机科学前沿（英文版）

基　　金：This work was supported by the National Natural Science Foundation of China(Grant Nos.61872312,61972335,and 62002309);the Natural Science Foundation of the Jiangsu Higher Education Institutions of China(20KJB520016);the Innovation(Science and Technology)Project of Scientific Research Base of Nanjing University of Aeronautics and Astronautics(NJ2020022).

摘　　要：1 Introduction Software evolves with the code change,including fixing the vulnerabilities,refactoring the software and adding new functions.Particularly,developers from open-source projects often look for the information of inducing commits when devising the fixing patches of a vulnerability[1].In the process of fixing the current vulnerabilities,it is inevitable to introduce new vulnerabilities.As is shown in Fig.1,after vulnerability1 occurs,developers committed the code changes to fix vulnerability1,but cause vulnerability2.In this paper,commits that introduce new vulnerabilities are called vulnerability-inducing commits,and commits that finally fix the vulnerability are known as vulnerability-fixing commits.In the following,they are abbreviated as vul-inducing commits and vul-fixing commits,respectively.

关 键 词：FUNCTIONS commit finally 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]