2020/01/24 by Arthur D. Sawadogo, Tegawendé F. Bissyandé, Sawadogo, Arthur D. +11 · 11 citations
Computer Science · #Advanced Malware Detection Techniques #Business #Computer science #Computer security #FOS: Computer and information sciences #Information and Cyber Security #Software Engineering (cs.SE) #Software Engineering Research #cs.SE
paper · pdf · doi:10.48550/arxiv.2001.09148
published in arXiv (Cornell University) (Cornell University)
arxiv created 2020/01/24 · openalex publication_date 2020/01/24 · arxiv updated 2020/01/27 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Timely patching is paramount to safeguard users and maintainers against dire consequences of malicious attacks. In practice, patching is prioritized following the nature of the code change that is committed in the code repository. When such a change is labeled as being security-relevant, i.e., as fixing a vulnerability, maintainers rapidly spread the change and users are notified about the need to update to a new version of the library or of the application. Unfortunately, oftentimes, some security-relevant changes go unnoticed as they represent silent fixes of vulnerabilities. In this paper, we propose a Co-Training-based approach to catch security patches as part of an automatic monitoring service of code repositories. Leveraging different classes of features, we empirically show that such automation is feasible and can yield a precision of over 90% in identifying security patches, with an unprecedented recall of over 80%. Beyond such a benchmarking with ground truth data which demonstrates an improvement over the state-of-the-art, we confirmed that our approach can help catch security patches that were not reported as such.