Scholarlink

<p>Open-source software (OSS) has become pervasive in modern software ecosystems; however, the inability to promptly comprehend newly introduced vulnerabilities poses substantial security risks. A particularly pressing challenge stems from silent OSS updates, in which downstream users often remain unaware of latent vulnerabilities, resulting in delayed mitigation and prolonged exposure to persistent, indirect, and potentially stealthy attacks. While prior research has examined the detection of silent vulnerability fixes, it frequently neglects an essential requirement: delivering precise vulnerability aspects that enable third-party developers to mitigate risks effectively. To bridge this gap, we present <span>VulPilot</span>, a novel framework for aspect-level vulnerability explanation generation via semantics-aware commit representation learning. <span>VulPilot</span> addresses two core challenges: (1) the limitations of existing representation learning strategies and (2) noise in commit messages. First, it constructs differential program dependency graphs (diff-PDGs) and applies program slicing to extract semantics-aware code contexts, thereby capturing vulnerability-relevant control and data flows. Second, it incorporates a denoising mechanism for commit messages by ranking key phrases using mask similarity, filtering out irrelevant content while preserving critical vulnerability aspects. Experimental results show that <span>VulPilot</span> surpasses state-of-the-art baselines, yielding ROUGE-L improvements of 5.9%–18.8%. A user study further substantiates its practical utility, indicating that explanations generated by <span>VulPilot</span> substantially enhance both vulnerability comprehension and mitigation efficiency.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Aspect-centric vulnerability understanding via semantics-aware commit representation learning

  • 期刊论文

  • 发表日期：

    2026年6月26日

查看全文
  • Xiaobing Sun,
  • Yifan Xu,
  • Sicong Cao,
  • Zhenlei Ye

摘要

Open-source software (OSS) has become pervasive in modern software ecosystems; however, the inability to promptly comprehend newly introduced vulnerabilities poses substantial security risks. A particularly pressing challenge stems from silent OSS updates, in which downstream users often remain unaware of latent vulnerabilities, resulting in delayed mitigation and prolonged exposure to persistent, indirect, and potentially stealthy attacks. While prior research has examined the detection of silent vulnerability fixes, it frequently neglects an essential requirement: delivering precise vulnerability aspects that enable third-party developers to mitigate risks effectively. To bridge this gap, we present VulPilot, a novel framework for aspect-level vulnerability explanation generation via semantics-aware commit representation learning. VulPilot addresses two core challenges: (1) the limitations of existing representation learning strategies and (2) noise in commit messages. First, it constructs differential program dependency graphs (diff-PDGs) and applies program slicing to extract semantics-aware code contexts, thereby capturing vulnerability-relevant control and data flows. Second, it incorporates a denoising mechanism for commit messages by ranking key phrases using mask similarity, filtering out irrelevant content while preserving critical vulnerability aspects. Experimental results show that VulPilot surpasses state-of-the-art baselines, yielding ROUGE-L improvements of 5.9%–18.8%. A user study further substantiates its practical utility, indicating that explanations generated by VulPilot substantially enhance both vulnerability comprehension and mitigation efficiency.