TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits

Problem

Identifying vulnerability-inducing commits (VICs) in software is challenging due to the evolution of code across revisions. This paper addresses this gap by proposing a novel approach that leverages temporal graph structures to enhance the identification and ranking of VICs. The work is presented as a preprint and has not yet undergone peer review.

Method

The authors introduce a temporal graph-based method for VIC identification and ranking. Key components of the method include:

• Graph Representation: The approach constructs graphs that capture the program structure and the evolution of vulnerability-relevant code across different revisions.
• Temporal Edges: These edges maintain correspondences between program elements across revisions, allowing for effective tracing of code changes.
• Localization: The method localizes likely root-cause lines of vulnerabilities and traces their histories through the revisions of the codebase.
• Ranking Mechanism: Candidate commits are ranked based on their contribution to the vulnerable condition, facilitating the identification of the most critical changes that may have introduced vulnerabilities.

Results

The proposed method demonstrates significant improvements over previous approaches:

• F2 Score Improvement: The F2 score increased from 0.637 to 0.814, indicating enhanced precision and recall in identifying VICs.
• VIC Identification Rate: The method successfully identified 78 out of 79 vulnerabilities across four unseen C/C++ projects, showcasing its robustness and effectiveness.
• Performance Improvement: The method achieves up to 28.7% improvement over state-of-the-art methods in the domain of vulnerability identification.

Limitations

The authors do not report any limitations in their work. However, as with any novel approach, potential limitations could include the scalability of the method to larger codebases or the generalizability across different programming languages beyond C/C++.

Why it matters

The implications of this work are significant for software security and maintenance. By improving the identification of VICs, TraceVIC can aid developers in proactively addressing vulnerabilities, thereby enhancing software reliability and security. This method could serve as a foundation for future research in automated vulnerability detection and code analysis, potentially leading to more robust software development practices.