English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

To help application developers apply vulnerability patches timely, securityresearchers maintain vulnerability databases such as National VulnerabilityDatabase (NVD). By directly monitoring NVD with the name of each used library,application developers can be aware of vulnerabilities and their patches. Giventhat the monitoring results of vulnerability patches are unreliable due topatch incompleteness of NVD, existing approaches employ deep-learning (DL)models to identify additional vulnerability patches by determining whether acode commit fixes a vulnerability. However, these approaches suffer from lowaccuracy due to not considering code commits' comprehensive contexts such ascontrol/data-flow contexts or method-invocation contexts. To improve accuracy,we design CompVPD, the first approach to identify vulnerability patches byfine-tuning a large language model (LLM) named StarCoder to comprehend codecommits with comprehensive contexts. Considering that including comprehensivecontexts needs to balance the context size and the training costs of LLM,CompVPD includes our two novel algorithms to generate comprehensive contextswithin the given window size by removing irrelevant components (i.e., files,methods, and statements) and adaptively expanding each context. We empiricallycompare CompVPD with four state-of-the-art/practice (SOTA) approaches thatidentify vulnerability patches. The results show that CompVPD improves the AUCscore by 11% and the F1 score by 30% when compared with the best scores of theSOTA approaches. Additionally, CompVPD provides high value to security practiceby helping identify 20 vulnerability patches and 18 fixes of high-risk bugsfrom 2,500 recent code commits of five highly popular open-source projects.

Identifying Vulnerability Patches by Comprehending Code Commits with Comprehensive Change Contexts