  The growing dependence of software projects on external libraries has
generated apprehensions regarding the security of these libraries because of
concealed vulnerabilities. Handling these vulnerabilities presents difficulties
due to the temporal delay between remediation and public exposure. Furthermore,
a substantial fraction of open-source projects covertly address vulnerabilities
without any formal notification, influencing vulnerability management.
Established solutions like OWASP predominantly hinge on public announcements,
limiting their efficacy in uncovering undisclosed vulnerabilities. To address
this challenge, the automated identification of vulnerability-fixing commits
has come to the forefront. In this paper, we present VFFINDER, a novel
graph-based approach for automated silent vulnerability fix identification.
VFFINDER captures structural changes using Abstract Syntax Trees (ASTs) and
represents them in annotated ASTs. To precisely capture the meaning of code
changes, the changed code is represented in connection with the related
unchanged code. In VFFINDER, the structure of the changed code and related
unchanged code are captured and the structural changes are represented in
annotated Abstract Syntax Trees (aAST). VFFINDER distinguishes
vulnerability-fixing commits from non-fixing ones using attention-based graph
neural network models to extract structural features expressed in aASTs. We
conducted experiments to evaluate VFFINDER on a dataset of 11K+ vulnerability
fixing commits in 507 real-world C/C++ projects. Our results show that VFFINDER
significantly improves the state-of-the-art methods by 272-420% in Precision,
22-70% in Recall, and 3.2X-8.2X in F1. Especially, VFFINDER speeds up the
silent fix identification process by up to 121% with the same effort reviewing
50K LOC compared to the existing approaches.
