TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks vulnerability-inducing commits by reasoning over how vulnerable code evolves across revisions.
TraceVIC identifies vulnerability-inducing commits by localizing likely root-cause lines, tracing them through revision history, and ranking commits by their contribution to the vulnerable condition instead of picking the earliest or latest git-blame change. Temporal graph edges preserve correspondences between program elements across consecutive revisions. Ablations show modeling the full history improves F2 from 0.637 to 0.814. The authors report up to a 28.7% F2 gain over prior methods and a valid inducing commit for 78 of 79 vulnerabilities in four unseen C/C++ projects.
- Rejects git-blame earliest-or-latest heuristics for finding inducing commits.
- Temporal graphs connect vulnerability-relevant code across revisions.
- Full-history modeling raises F2 from 0.637 to 0.814.
- A valid inducing commit was found for 78 of 79 cases.
- Products
- Git
From the original article
1 min read at arxiv.orgSoftware vulnerabilities are often discovered long after they are introduced, making it difficult to identify the vulnerability-inducing commit (VIC) responsible for introducing the underlying vulnerable condition. Existing VIC identification techniques largely rely on git blame to trace vulnerable code through revision history and use positional heuristics, such as selecting its earliest or most recent modification.
By Fnu Tanish · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.