PatchDB: A Large-Scale Security Patch Dataset

Wang, Xinda; Wang, Shu; Feng, Pengbin; Sun, Kun; Jajodia, Sushil

doi:10.1109/dsn48987.2021.00030

Cited by 26 publications

(7 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Methodology for comparison. We reviewed several approaches that attempted to collect security patches [10]- [12], [18], [21], [23], [25]. We classified the number of security patches collected by existing approaches according to the link type we defined.…”

Section: B Coverage Of Xvdbmentioning

confidence: 99%

“…Collecting known security patches. Several approaches (e.g., [11], [12], [18], [21]- [23], [25]) have attempted to construct vulnerability databases by collecting security patches. However, most of the existing approaches only covered security patches that could be collected from repositories, especially Git (e.g., [11], [12], [18], [21]- [23]), as we discussed throughout this paper.…”

Section: Related Workmentioning

confidence: 99%

“…Several approaches (e.g., [11], [12], [18], [21]- [23], [25]) have attempted to construct vulnerability databases by collecting security patches. However, most of the existing approaches only covered security patches that could be collected from repositories, especially Git (e.g., [11], [12], [18], [21]- [23]), as we discussed throughout this paper. In addition, they only focused on collecting security patches with direct patch links, i.e., missing many security patches with indirect and invisible patch links.…”

Section: Related Workmentioning

confidence: 99%

“…To prevent such attacks, developers mainly use the following two methods: (1) OSS version updates (e.g., [5], [26]) and (2) fixing vulnerable source codes by leveraging Common Vulnerabilities and Exposures (CVE) information (e.g., [9], [10], [27]). To proceed with such methods, especially the latter one, it is necessary to construct a large-scale vulnerability database, which is containing security patches and vulnerable codes [21], [23].…”

mentioning

confidence: 99%

“…Despite the importance of constructing a vulnerability database, existing approaches have limited in terms of collecting abundant security patches. Several approaches (e.g., [11], [18], [21]- [23], [25]) attempted to construct vulnerability database, but they exhibited low patch collection coverage owing to the following two reasons: (1) limited data sources and (2) shallow scanning problems. Although vulnerability information is distributed among various data sources, previous approaches only focused on GitHub as their target data source for collecting security patches.…”

mentioning

confidence: 99%

See 4 more Smart Citations

xVDB: A High-Coverage Approach for Constructing a Vulnerability Database

et al. 2022

View full text Add to dashboard Cite

Security patches play an important role in detecting and fixing one-day vulnerabilities. However, collecting abundant security patches from diverse data sources is not a simple task. This is because (1) each data source provides vulnerability information in a different way and (2) many security patches cannot be directly collected from Common Vulnerabilities and Exposures (CVE) information (e.g., National Vulnerability Database (NVD) references). In this paper, we propose a high-coverage approach that collects known security patches by tracking multiple data sources. Specifically, we considered the following three data sources: repositories (e.g., GitHub), issue trackers (e.g., Bugzilla), and Q&A sites (e.g., Stack Overflow). From the data sources, we gather even security patches that cannot be collected by considering only CVE information (i.e., previously untracked security patches). In our experiments, we collected 12,432 CVE patches from repositories and issue trackers, and 12,458 insecure posts from Q&A sites. We could collect at least four times more CVE patches than those collected in existing approaches, which demonstrates the efficacy of our approach. The collected security patches serves as a database on a public website (i.e., IoTcube) to proceed with the detection of vulnerable code clones.

show abstract