← 研踪 PaperTrailarXiv:2611.09026 · v1
Beyond a Single Commit: Anchor-Guided Reconstruction of Multi-Commit Patches
首次提交 2026-11-06 14:00
版本更新 2026-11-06 14:00
雷达观测 2026-11-09 11:19
摘要
Vulnerability patch identification plays a critical role in software security by linking reported vulnerabilities and the corresponding fixes, enabling reliable vulnerability analysis, mitigation, and automated security tool development. As software systems evolve in complexity, vulnerability remediation has increasingly shifted from single-commit fixes to multi-commit fixing processes. Although many studies have been proposed to identify fixing commits associated with target vulnerabilities automatically, they often suffer from inaccurate semantic analysis or excessive workload for language models. These limitations reduce both the effectiveness and comprehensiveness of fixing commit identification. To improve patch identification, we propose an effective and comprehensive patch identification framework, HARPOON, which not only enhances the accuracy of identifying individual fixing commits, but also investigates dependencies among commits to achieve comprehensive commit recognition for target vulnerabilities. Experimental results show that HARPOON significantly outperforms the state-of-the-art approaches. HARPOON successfully identified 895 vulnerability patches that were not previously maintained in public vulnerability databases. Among them, 663 are previously unrecorded fixes associated with 323 CRITICAL- or HIGH-severity vulnerabilities.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-06 14:00 · 最新观测版本
Beyond a Single Commit: Anchor-Guided Reconstruction of Multi-Commit Patches
Vulnerability patch identification plays a critical role in software security by linking reported vulnerabilities and the corresponding fixes, enabling reliable vulnerability analysis, mitigation, and automated security tool development. As software systems evolve in complexity, vulnerability remediation has increasingly shifted from single-commit fixes to multi-commit fixing processes. Although many studies have been proposed to identify fixing commits associated with target vulnerabilities automatically, they often suffer from inaccurate semantic analysis or excessive workload for language models. These limitations reduce both the effectiveness and comprehensiveness of fixing commit identification. To improve patch identification, we propose an effective and comprehensive patch identification framework, HARPOON, which not only enhances the accuracy of identifying individual fixing commits, but also investigates dependencies among commits to achieve comprehensive commit recognition for target vulnerabilities. Experimental results show that HARPOON significantly outperforms the state-of-the-art approaches. HARPOON successfully identified 895 vulnerability patches that were not previously maintained in public vulnerability databases. Among them, 663 are previously unrecorded fixes associated with 323 CRITICAL- or HIGH-severity vulnerabilities.
查看此版本解读 →查看此版本原文 ↗