用机器学习先筛漏洞修复候选，再测试，提升效率。
Using ML filters to help automated vulnerability repairs: when it helps and when it doesn't
- ML模型做初步筛选，减少后续测试负担
- 理论证明了模型需达到一定精度才有效
- 适合追求修复速度的自动化漏洞修复场景
自动化程序修复中，候选补丁通常依赖测试断言来筛选。测试成本高，而机器学习模型可快速分类补丁，实现更高效的正向反馈循环。但当模型预测不可靠（如漏洞检测）时，难以替代可靠的测试断言。本文提出将机器学习模型作为前置过滤器，置于传统测试过滤器之前。我们推导出使该流程在实践中有效的机器学习算法精度与召回率的理论边界。结合已有文献结果，计算出某些前沿漏洞检测器需达到何种速度，才能在仅依赖测试的传统修复流程（如 APR4Vuln）上表现更优。
原文摘要 · Abstract (English)
[Context:] The acceptance of candidate patches in automated program repair has been typically based on testing oracles. Testing requires typically a costly process of building the application while ML models can be used to quickly classify patches, thus allowing more candidate patches to be generated in a positive feedback loop. [Problem:] If the model predictions are unreliable (as in vulnerability detection) they can hardly replace the more reliable oracles based on testing. [New Idea:] We propose to use an ML model as a preliminary filter of candidate patches which is put in front of a traditional filter based on testing. [Preliminary Results:] We identify some theoretical bounds on the precision and recall of the ML algorithm that makes such operation meaningful in practice. With these bounds and the results published in the literature, we calculate how fast some of state-of-the art vulnerability detectors must be to be more effective over a traditional AVR pipeline such as APR4Vuln based just on testing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。