Mapping NVD Records to Their Vulnerability-fixing Commits: How Hard is It?
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866909053169434624 |
|---|---|
| author | Nguyen, Huu Hung Zhang, Ting Tran, Duc Manh Cheng, Yiran Le-Cong, Thanh Kang, Hong Jin Widyasari, Ratnadira Khin, Shar Lwin Lieh, Ouh Eng Lo, David |
| author_facet | Nguyen, Huu Hung Zhang, Ting Tran, Duc Manh Cheng, Yiran Le-Cong, Thanh Kang, Hong Jin Widyasari, Ratnadira Khin, Shar Lwin Lieh, Ouh Eng Lo, David |
| contents | Mapping National Vulnerability Database (NVD) records to vulnerability-fixing commits (VFCs) is crucial for vulnerability analysis but challenging due to sparse explicit links in NVD references. This study explores this mapping's feasibility through an empirical approach. Manual analysis of NVD references showed Git references enable over 86% success, while non-Git references achieve under 14%. Using these findings, we built an automated pipeline extracting 31,942 VFCs from 20,360 NVD records (8.7% of 235,341) with 87% precision, mainly from Git references. To fill gaps, we mined six external security databases, yielding 29,254 VFCs for 18,985 records (8.1%) at 88.4% precision, and GitHub repositories, adding 3,686 VFCs for 2,795 records (1.2%) at 73% precision. Combining these, we mapped 26,710 unique records (11.3% coverage) from 7,634 projects, with overlap between NVD and external databases, plus unique GitHub contributions. Despite success with Git references, 88.7% of records remain unmapped, highlighting the difficulty without Git links. This study offers insights for enhancing vulnerability datasets and guiding future automated security research. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_09702 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Mapping NVD Records to Their Vulnerability-fixing Commits: How Hard is It? Nguyen, Huu Hung Zhang, Ting Tran, Duc Manh Cheng, Yiran Le-Cong, Thanh Kang, Hong Jin Widyasari, Ratnadira Khin, Shar Lwin Lieh, Ouh Eng Lo, David Software Engineering Cryptography and Security Mapping National Vulnerability Database (NVD) records to vulnerability-fixing commits (VFCs) is crucial for vulnerability analysis but challenging due to sparse explicit links in NVD references. This study explores this mapping's feasibility through an empirical approach. Manual analysis of NVD references showed Git references enable over 86% success, while non-Git references achieve under 14%. Using these findings, we built an automated pipeline extracting 31,942 VFCs from 20,360 NVD records (8.7% of 235,341) with 87% precision, mainly from Git references. To fill gaps, we mined six external security databases, yielding 29,254 VFCs for 18,985 records (8.1%) at 88.4% precision, and GitHub repositories, adding 3,686 VFCs for 2,795 records (1.2%) at 73% precision. Combining these, we mapped 26,710 unique records (11.3% coverage) from 7,634 projects, with overlap between NVD and external databases, plus unique GitHub contributions. Despite success with Git references, 88.7% of records remain unmapped, highlighting the difficulty without Git links. This study offers insights for enhancing vulnerability datasets and guiding future automated security research. |
| title | Mapping NVD Records to Their Vulnerability-fixing Commits: How Hard is It? |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2506.09702 |