Write a Blog >>
ESEC/FSE 2022
Mon 14 - Fri 18 November 2022 Singapore
Wed 16 Nov 2022 14:15 - 14:30 at SRC LT 53 - Program Repair/Synthesis Chair(s): Saikat Chakraborty

As software vulnerabilities grow in volume and complexity, researchers proposed various Artificial Intelligence (AI)-based approaches to help under-resourced security analysts to find, detect, and localize vulnerabilities. However, security analysts still have to spend a huge amount of effort to manually fix or repair such vulnerable functions. Recent work proposed an NMT-based Automated Vulnerability Repair, but it is still far from perfect due to various limitations. In this paper, we propose VulRepair, a T5-based automated software vulnerability repair approach that leverages the pre-training and BPE components to address various technical limitations of prior work. Through an extensive experiment with over 8,482 vulnerability fixes from 1,754 real-world software projects, we find that our VulRepair achieves a Perfect Prediction of 44%, which is 13%-21% more accurate than competitive baseline approaches. These results lead us to conclude that our VulRepair is considerably more accurate than two baseline approaches, highlighting the substantial advancement of NMT-based Automated Vulnerability Repairs. Our additional investigation also shows that our VulRepair can accurately repair as many as 745 out of 1,706 real-world well-known vulnerabilities (e.g., Use After Free, Improper Input Validation, OS Command Injection), demonstrating the practicality and significance of our VulRepair for generating vulnerability repairs, helping under-resourced security analysts on fixing vulnerabilities.

Wed 16 Nov

Displayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change

14:00 - 15:30
Program Repair/SynthesisResearch Papers / Industry Paper at SRC LT 53
Chair(s): Saikat Chakraborty Microsoft Research
14:00
15m
Talk
PyTER: Effective Program Repair for Python Type Errors
Research Papers
Wonseok Oh Korea University, Hakjoo Oh Korea University
DOI
14:15
15m
Talk
VulRepair: A T5-Based Automated Software Vulnerability Repair
Research Papers
Micheal Fu Monash University, Kla Tantithamthavorn Monash University, Trung Le Monash University, Australia, Van Nguyen Monash University, Australia, Dinh Phung Monash University, Australia
DOI
14:30
15m
Talk
An Empirical Study of Deep Transfer Learning-Based Program Repair for Kotlin Projects
Industry Paper
Misoo Kim Sungkyunkwan University, Youngkyoung Kim Sungkyunkwan University, Hohyeon Jeong Sungkyunkwan University, Jinseok Heo Sungkyunkwan University, Sungoh Kim Samsung Electronics, Hyunhee Chung Samsung Electronics, Eunseok Lee Sungkyunkwan University
DOI
14:45
15m
Talk
DeepDev-PERF: A Deep Learning-Based Approach for Improving Software Performance
Research Papers
Spandan Garg Microsoft, Roshanak Zilouchian Moghaddam Microsoft, Colin Clement Microsoft, Neel Sundaresan Microsoft, Chen Wu Microsoft
DOI
15:00
15m
Talk
Less Training, More Repairing Please: Revisiting Automated Program Repair via Zero-Shot Learning
Research Papers
Chunqiu Steven Xia University of Illinois at Urbana-Champaign, Lingming Zhang University of Illinois at Urbana-Champaign
DOI