CVEfixes: automated collection of vulnerabilities and their fixes from open-source software (2021-07-19T00:00:00.000000Z)

TL;DR

This work proposes a method to automatically collect and curate a comprehensive vulnerability dataset from Common Vulnerabilities and Exposures records in the public National Vulnerability Database (NVD), and shares an initial release of the resulting vulnerability dataset named CVEfixes.

Abstract

Data-driven research on the automated discovery and repair of security vulnerabilities in source code requires comprehensive datasets of real-life vulnerable code and their fixes. To assist in such research, we propose a method to automatically collect and curate a comprehensive vulnerability dataset from Common Vulnerabilities and Exposures (CVE) records in the National Vulnerability Database (NVD). We implement our approach in a fully automated dataset collection tool and share an initial release of the resulting vulnerability dataset named CVEfixes. The CVEfixes collection tool automatically fetches all available CVE records from the NVD, gathers the vulnerable code and corresponding fixes from associated open-source repositories, and organizes the collected information in a relational database. Moreover, the dataset is enriched with meta-data such as programming language, and detailed code and security metrics at five levels of abstraction. The collection can easily be repeated to keep up-to-date with newly discovered or patched vulnerabilities. The initial release of CVEfixes spans all published CVEs up to 9 June 2021, covering 5365 CVE records for 1754 open-source projects that were addressed in a total of 5495 vulnerability fixing commits. CVEfixes supports various types of data-driven software security research, such as vulnerability prediction, vulnerability classification, vulnerability severity prediction, analysis of vulnerability-related code changes, and automated vulnerability repair.

Authors

G. Bhandari

2 papers

Amara Naseer

1 papers

L. Moonen

2 papers

References52 items

<inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq1-2942930.gif"/></alternatives></inline-formula>VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

TL;DR

Abstract

Authors

References52 items

<inline-formula><tex-math notation="LaTeX">$\mu$</tex-math><alternatives><mml:math><mml:mi>μ</mml:mi></mml:math><inline-graphic xlink:href="zou-ieq1-2942930.gif"/></alternatives></inline-formula>VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

On the Effectiveness of Deep Vulnerability Detectors to Simple Stupid Bug Detection

A large-scale study on human-cloned changes for automated program repair

Applying CodeBERT for Automated Program Repair of Java Simple Bugs

On the Rise and Fall of Simple Stupid Bugs: a Life-Cycle Analysis of SStuBs

D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis

Automatic Feature Learning for Predicting Vulnerable Software Components

Findings of the Association for Computational Linguistics: EMNLP 2020

World of code: enabling a research workflow for mining and analyzing the universe of open source VCS data

Inspecting JavaScript Vulnerability Mitigation Patches with Automated Fix Generation in Mind

Code analysis for intelligent cyber systems: A data-driven approach

Software Vulnerability Detection Using Deep Neural Networks: A Survey

A C/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries

Automated Vulnerability Detection in Source Code Using Minimum Intermediate Representation Learning

CodeBERT: A Pre-Trained Model for Programming and Natural Languages

Collecting Vulnerable Source Code from Open-Source Repositories for Dataset Generation

Deep Learning-Based Vulnerable Function Detection: A Benchmark

Using Sequence-to-Sequence Learning for Repairing C Vulnerabilities

Project Achilles: A Prototype Tool for Static Method-Level Vulnerability Detection of Java Source Code Using a Recurrent Neural Network

From Reports to Bug-Fix Commits: A 10 Years Dataset of Bug-Fixing Activity from 55 Apache's Open Source Projects

Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks

Detecting "0-Day" Vulnerability: An Empirical Study of Secret Security Patch in OSS

How Often Do Single-Statement Bugs Occur? The ManySStuBs4J Dataset

The Delta Maintainability Model: Measuring Maintainability of Fine-Grained Code Changes

A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software

SequenceR: Sequence-to-Sequence Learning for End-to-End Program Repair

PyDriller: Python framework for mining software repositories

PatchSweetner: Exploit Detection Through the Automatic Transformation of Security Patches

Automated Vulnerability Detection in Source Code Using Deep Representation Learning

A Practical Approach to the Automatic Classification of Security-Relevant Commits

Pre-Patch: Find Hidden Threats in Open Software Based on Machine Learning Method

VulinOSS: A Dataset of Security Vulnerabilities in Open-Source Systems

Perceval: Software Project Data at Your Will

A Software Assurance Reference Dataset: Thousands of Programs With Known Bugs.

Common Vulnerability and Exposures (CVE)

VulDeePecker: A Deep Learning-Based System for Vulnerability Detection

End-to-End Prediction of Buffer Overruns from Raw Source Code via Neural Memory Networks

Software Metrics and Security Vulnerabilities: Dataset and Exploratory Study

Predicting Cross-Site Scripting (XSS) security vulnerabilities in web applications

Challenges with applying vulnerability prediction models

The impact of tangled code changes on defect prediction models

MARFCAT: Fast code analysis for defects and vulnerabilities

The Vulnerability Dataset of a Large Software Ecosystem

The Use of NLP Techniques in Static Code Analysis to Detect Weaknesses and Vulnerabilities

Automatic detection and correction of web application vulnerabilities using data mining to predict false positives

Juliet 1.1 C/C++ and Java Test Suite

The Forum of Incident Response and Security Teams (FIRST)

Enabling the Continous Analysis of Security Vulnerabilities with VulData7

Text-Mining and Pattern-Matching based Prediction Models for Detecting Vulnerable Files in Web Applications

PROMISE ’21, August 19–20, 2021,

Common Weakness Enumeration (CWE)

url: https: //cve.mitre.org/ (visited on

Field of Study

Journal Information

Name

Venue Information

Name

Type

URL

Alternate Names