  Bug tracking systems store many bug reports, some of which are related to
security. Identifying those security bug reports (SBRs) may help us predict
some security-related bugs and solve security issues promptly so that the
project can avoid threats and attacks. However, in the real world, the ratio of
security bug reports is severely low; thus, directly training a prediction
model with raw data may result in inaccurate results. Faced with the massive
challenge of data imbalance, many researchers in the past have attempted to use
text filtering or clustering methods to minimize the proportion of non-security
bug reports (NSBRs) or apply oversampling methods to synthesize SBRs to make
the dataset as balanced as possible. Nevertheless, there are still two
challenges to those methods: 1) They ignore long-distance contextual
information. 2) They fail to generate an utterly balanced dataset. To tackle
these two challenges, we propose SEDAC, a new SBR identification method that
generates similar bug report vectors to solve data imbalance problems and
accurately detect security bug reports. Unlike previous studies, it first
converts bug reports into individual bug report vectors with distilBERT, which
are based on word2vec. Then, it trains a generative model through conditional
variational auto-encoder (CVAE) to generate similar vectors with security
labels, which makes the number of SBRs equal to NSBRs'. Finally, balanced data
are used to train a security bug report classifier. To evaluate the
effectiveness of our framework, we conduct it on 45,940 bug reports from
Chromium and four Apache projects. The experimental results show that SEDAC
outperforms all the baselines in g-measure with improvements of around
14.24%-50.10%.
