Building a Commit-level Dataset of Real-world Vulnerabilities - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Building a Commit-level Dataset of Real-world Vulnerabilities

Robin David
  • Fonction : Auteur
  • PersonId : 782970
  • IdRef : 200251783

Résumé

While Common Vulnerabilities and Exposures (CVE) has become de facto a standard for publishing advisories on vulnerabilities, the state of current CVE databases is lackluster. Yet, CVE advisories are insufficient to bridge the gap with the vulnerability artifacts in the impacted program. Therefore, the community is lacking a public real-world vulnerabilities dataset providing such association. In this paper, we present a method restoring this missing link by analyzing the vulnerabilities from Android Open Source Project (AOSP), an aggregate of more than 1,800 projects. It is the perfect target for building a representative dataset of vulnerabilities. Indeed, AOSP covers the full spectrum that may be encountered in a modern system where a variety of low-level and higher-level components interact. More specifically, our main contribution is a dataset of more than 1,900 vulnerabilities associating generic metadata (e.g. vulnerability type, impact level) with their respective patches at the commit granularity (e.g. fix commit-id, affected files, source code language). Finally, we also augment this dataset by providing precompiled binaries for a subset of the vulnerabilities. These binaries open various data usage, both for binary only analysis and at the interface between source and binary. In addition to providing a common baseline benchmark, the our dataset release supports the community for data-driven software security research.
Fichier principal
Vignette du fichier
main.pdf (299.66 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03477866 , version 1 (21-04-2022)

Identifiants

  • HAL Id : hal-03477866 , version 1

Citer

Alexis Challande, Robin David, Guénaël Renault. Building a Commit-level Dataset of Real-world Vulnerabilities. CODASPY 2022 - 12th ACM Conference on Data and Application Security and Privacy, Apr 2022, Baltimore MD USA, United States. pp.101-106. ⟨hal-03477866⟩
84 Consultations
516 Téléchargements

Partager

Gmail Facebook X LinkedIn More