Towards Identifying Vulnerabilities with Delayed Patching and Public Disclosure in Open-Source Communities
Bibliographic record
Abstract
The number of open-source software (OSS) projects has been increasing over the last few years. OSS projects are widely used either directly or as a nth dependency. However, OSS projects also have an increasing trend of vulnerabilities. These vulnerabilities are not effectively managed with consideration to timely patching and disclosures, ultimately leading to exploits. Moreover, due to the nature of OSS, the activities, including code changes, discussions, etc, are available to the public and thus can be monitored by malicious hackers to create exploits. Further, there is a large time gap between the vulnerability reporting, discussion, patching, and disclosure stages, which can be misused to create exploits. In this Master’s Thesis, we explore the mismanagement of vulnerabilities, particularly delays in the disclosures and patching process. Further, we analyze the vulnerabilities with extremely large gaps (i.e., more than 365 days and term them as“Delinquent Vulnerabilities”) between the reporting, discussion, and disclosure stages with the help of a thorough qualitative analysis to find the underlying reasons for the delays. We further evaluate the state-of-the-art (SOTA)vulnerability detection models on the collected set of these extremely delayed vulnerabilities. Further, we perform qualitative analysis on the delinquent vulnerabilities not detected by SOTA to derive insights for formulating strategies for more efficient detection of vulnerabilities. Accordingly, we develop a novel vulnerability detection approach.“DelinquentVulnDetector” that incorporates multiple types of artifacts observed during the vulnerability lifecycle to capture a combined representation for vulnerability detection. Lastly, we evaluate DelinquentVulnDetector along with the SOTA on a set of 275 vulnerabilities, wherein DelinquentVulnDetector detects 196 vulnerabilities while all the SOTAs combined can detect 182 DCVEs.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.002 | 0.000 |
| Meta-epidemiology (narrow) | 0.001 | 0.001 |
| Meta-epidemiology (broad) | 0.001 | 0.000 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.001 | 0.000 |
| Scholarly communication | 0.010 | 0.004 |
| Open science | 0.002 | 0.002 |
| Research integrity | 0.000 | 0.002 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".