  In this paper, we address the problem of automatic repair of software
vulnerabilities with deep learning. The major problem with data-driven
vulnerability repair is that the few existing datasets of known confirmed
vulnerabilities consist of only a few thousand examples. However, training a
deep learning model often requires hundreds of thousands of examples. In this
work, we leverage the intuition that the bug fixing task and the vulnerability
fixing task are related and that the knowledge learned from bug fixes can be
transferred to fixing vulnerabilities. In the machine learning community, this
technique is called transfer learning. In this paper, we propose an approach
for repairing security vulnerabilities named VRepair which is based on transfer
learning. VRepair is first trained on a large bug fix corpus and is then tuned
on a vulnerability fix dataset, which is an order of magnitude smaller. In our
experiments, we show that a model trained only on a bug fix corpus can already
fix some vulnerabilities. Then, we demonstrate that transfer learning improves
the ability to repair vulnerable C functions. We also show that the transfer
learning model performs better than a model trained with a denoising task and
fine-tuned on the vulnerability fixing task. To sum up, this paper shows that
transfer learning works well for repairing security vulnerabilities in C
compared to learning on a small dataset.
