The History Is the Detector: Executing CVE Patch History, End-to-End

Imagine you're a developer trying to ensure your software is secure from known vulnerabilities. You might rely on public databases that list software flaws, but these records are often designed for human review, not for automated systems. This means that even if a flaw is documented, similar unsafe conditions could still exist in your code without any alerts, leading to potential security risks. This situation is what's called a gap in automated vulnerability detection. To address this, the authors propose a framework called BUGSTONE-E2E, which takes historical vulnerability data and converts it into executable rules for detecting flaws. The idea is to mine fixing commits from past vulnerabilities to create reusable detection rules, organizing them by type and programming language. The process involves a multi-stage pipeline that starts with lightweight analysis to filter out benign code before applying more complex models to the remaining candidates. This method not only identifies potential vulnerabilities but also generates patches that can be validated through rigorous testing. Compared to previous approaches, BUGSTONE-E2E effectively leverages historical data to create a systematic workflow for vulnerability detection and repair. This means that developers can now automate the identification and fixing of vulnerabilities based on past incidents, significantly improving the security posture of their software without relying solely on manual inspection.

Transforms historical vulnerability data into actionable detection rules.

Demonstrates effectiveness on a substantial dataset with clear metrics.