Automated vulnerability detection system based on commit messages

Vulnerabilities in Open Source Software (OSS) are the major culprits of cyber-attacks and security breaches today. To avoid repetitive development and speed up release cycle, software teams nowadays are increasingly relying on OSS. However, many OSS users are unaware of the vulnerable components the...

Full description

Saved in:
Bibliographic Details
Main Author: Wan, Liuyang
Other Authors: Liu Yang
Format: Theses and Dissertations
Language:English
Published: 2019
Subjects:
Online Access:https://hdl.handle.net/10356/104726
http://hdl.handle.net/10220/48651
Tags: Add Tag
No Tags, Be the first to tag this record!
Institution: Nanyang Technological University
Language: English
id sg-ntu-dr.10356-104726
record_format dspace
spelling sg-ntu-dr.10356-1047262020-07-02T03:08:32Z Automated vulnerability detection system based on commit messages Wan, Liuyang Liu Yang School of Computer Science and Engineering DRNTU::Engineering::Computer science and engineering Vulnerabilities in Open Source Software (OSS) are the major culprits of cyber-attacks and security breaches today. To avoid repetitive development and speed up release cycle, software teams nowadays are increasingly relying on OSS. However, many OSS users are unaware of the vulnerable components they are using. Sometimes it will take weeks or even months for a Common Vulnerabilities and Exposures (CVE) to be determined and finally patched. Thus, to mitigate against cyber-attacks, it is important to understand both known CVEs and unknown vulnerabilities. In this thesis, we first conducted a large-scale crawling of Git commits for some popular open source repositories like Linux. Second, because there is no prior dataset for security-relevant Git commits, we developed a web-based triage system for security researchers to perform manual labelling of the commits. Finally, after the commits are cleaned and labelled, a deep neural network is implemented to automatically identify vulnerability-fixing commits (VFC) based on the commit messages. The approach has achieved significant better precision than state-of-the-art while improving the recall rate by 16.8%. In the end, we present a thorough quantitative and qualitative analysis of the results and discuss the lessons learned and room for future work. Master of Engineering 2019-06-12T01:49:47Z 2019-12-06T21:38:21Z 2019-06-12T01:49:47Z 2019-12-06T21:38:21Z 2019 Thesis Wan, L. (2019). Automated vulnerability detection system based on commit messages. Master's thesis, Nanyang Technological University, Singapore. https://hdl.handle.net/10356/104726 http://hdl.handle.net/10220/48651 10.32657/10220/48651 en 51 p. application/pdf
institution Nanyang Technological University
building NTU Library
country Singapore
collection DR-NTU
language English
topic DRNTU::Engineering::Computer science and engineering
spellingShingle DRNTU::Engineering::Computer science and engineering
Wan, Liuyang
Automated vulnerability detection system based on commit messages
description Vulnerabilities in Open Source Software (OSS) are the major culprits of cyber-attacks and security breaches today. To avoid repetitive development and speed up release cycle, software teams nowadays are increasingly relying on OSS. However, many OSS users are unaware of the vulnerable components they are using. Sometimes it will take weeks or even months for a Common Vulnerabilities and Exposures (CVE) to be determined and finally patched. Thus, to mitigate against cyber-attacks, it is important to understand both known CVEs and unknown vulnerabilities. In this thesis, we first conducted a large-scale crawling of Git commits for some popular open source repositories like Linux. Second, because there is no prior dataset for security-relevant Git commits, we developed a web-based triage system for security researchers to perform manual labelling of the commits. Finally, after the commits are cleaned and labelled, a deep neural network is implemented to automatically identify vulnerability-fixing commits (VFC) based on the commit messages. The approach has achieved significant better precision than state-of-the-art while improving the recall rate by 16.8%. In the end, we present a thorough quantitative and qualitative analysis of the results and discuss the lessons learned and room for future work.
author2 Liu Yang
author_facet Liu Yang
Wan, Liuyang
format Theses and Dissertations
author Wan, Liuyang
author_sort Wan, Liuyang
title Automated vulnerability detection system based on commit messages
title_short Automated vulnerability detection system based on commit messages
title_full Automated vulnerability detection system based on commit messages
title_fullStr Automated vulnerability detection system based on commit messages
title_full_unstemmed Automated vulnerability detection system based on commit messages
title_sort automated vulnerability detection system based on commit messages
publishDate 2019
url https://hdl.handle.net/10356/104726
http://hdl.handle.net/10220/48651
_version_ 1681059754432004096