一种面向开源软件漏洞的补丁查找与解析方法  

A METHOD FOR FINDING AND PARSING PATCHES FOR OPEN SOURCE SOFTWARE VULNERABILITIES

作　　者：许聪颖 陈碧欢[1,2] 赵文耘 Xu Congying;Chen Bihuan;Zhao Wenyun(Software School,Fudan University,Shanghai 200438,China;Shanghai Key Laboratory of Data Science,Shanghai 200438,China)

机构地区：[1]复旦大学软件学院,上海200438 [2]上海市数据科学重点实验室,上海200438

出　　处：《计算机应用与软件》2025年第4期1-7,32,共8页Computer Applications and Software

基　　金：国家自然科学基金项目(61802067)。

摘　　要：漏洞补丁为多种软件安全任务提供了重要知识,但在漏洞公告中常常缺失。提出一种面向开源软件漏洞的自动化补丁查找与解析方法PatFinder。该方法先从大量网页中识别漏洞相关的代码提交,再基于代码变更内容及加权投票的机制实现补丁筛选,最后,通过定制化的补丁解析方法,获取文件路径、函数名等补丁元数据信息。实验结果表明,该方法可达到73.10%的补丁覆盖率和0.802的补丁查全率,大幅提升了现有方法的补丁覆盖率和查全率。Patches,as a valuable piece of information for security-related tasks,are often missing in security advisories.In this article,we propose an automated approach,named PatFinder,to find and parse patches for open source software(OSS)vulnerabilities.First,PatFinder identified commits from numerous vulnerability-related references.Then,PatFinder selected patches based on code changes of identified commits and a weighted voting mechanism.Finally,based on designed patch parsing methods,metadata of patches(i.e.,paths of modified files and names of functions)was obtained.Our experiment has shown that PatFinder can achieve a coverage of 73.10%and a recall of 0.802,significantly improving the coverage and recall of existing approaches.

关 键 词：软件安全 漏洞 补丁 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]