Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

SoK: Automated Vulnerability Repair: Methods, Tools, and Assessments

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper systematizes automated vulnerability repair into a three-step workflow, introduces Vul4C — the first C/C++ repair benchmark in which all 144 vulnerabilities come with an exploit and a patch — and reports that semantics-based…

desk verdict Vul4C is a genuinely useful benchmark with careful construction, but the paper's headline semantics-vs-learning ranking does not survive contact with its own evaluation design. read the letter →

arxiv 2506.11697 v1 pith:HNC4QP6O submitted 2025-06-13 cs.SE

Yiwei Hu , Zhen Li , Kedie Shu , Shenghua Guan , Deqing Zou , Shouhuai Xu , Bin Yuan , Hai Jin This is my paper
classification cs.SE
keywords automatedvulnerabilityrepairbenchmarkdatasetC/C++vulnerabilitiespatchgenerationlocalizationvalidationsemantics-basedlearning-based
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper systematizes the field of Automated Vulnerability Repair (AVR) — fixing security bugs automatically — into a three-step workflow: analyzing the vulnerability, generating candidate patches, and validating those patches. To make AVR tools comparable, the authors built Vul4C, which they describe as the first C/C++ vulnerability-repair benchmark whose 144 real vulnerabilities each come with an exploit, a patch, and triggering information, spanning 19 vulnerability types across 23 software products. They used Vul4C to evaluate seven C/C++ AVR tools and the third-party Vul4J dataset for two Java tools. The central empirical claim is that tools generating patches from program semantics (sanitizer and constraint analysis) produce higher-quality patches than learning-based tools, which typically fail at placing their generated code, and that even the better tools supply plausible rather than truly correct patches most of the time. The paper also concludes that vulnerability localization is the bottleneck of the whole workflow.

What carries the argument

The carrying object is Vul4C, a benchmark of 144 real C/C++ vulnerabilities collected from seven sources (ExtractFix, VulnLoc, LinuxFlaw, PatchWeave, Senx's dataset, online exploit collections, and NVD records), each verified so that a sanitizer (AddressSanitizer, UBSAN, or low-fat pointers) reports the exploitation. The evaluation protocol is the second load-bearing mechanism: it compiles and runs each candidate patch against exploits and test suites, then has the authors manually judge whether plausible patches are semantically equivalent to human patches, using rates for restoration, compilation, test-pass, consistency, and success. For the comparison claim, the distinction that carries the argument is between semantics-based patch generation (solving the security constraint violated by the exploit, often with symbolic execution or fuzzing-derived invariants) and learning-based generation (neural models fine-tuned to translate vulnerable token sequences into patched ones), with the learning-based tools' three-token context placement strategy identified as the main source of their failures.

What would settle it

Evaluate all seven C/C++ tools on the intersection of the benchmark subsets they can each process (single-file, sanitizer-appropriate vulnerabilities that compile with the required toolchains) and recompute the three patch-quality rates per vulnerability. If semantics-based tools do not dominate learning-based tools on that common set, the ranking in Table 5 reflects vulnerability-subset selection rather than tool capability.

Watch

Extended reading notes

Core claim

The paper claims that AVR should be treated as a research problem distinct from general automated program repair, organized around the three-step workflow of vulnerability analysis, patch generation, and patch validation. Its central artifact is Vul4C, the first C/C++ vulnerability-repair benchmark containing 144 real-world vulnerabilities, each with an associated exploit, a developer patch, and vulnerability-triggering input and output information — features the paper argues prior datasets lack. Its central empirical finding, based on evaluating seven C/C++ AVR tools on Vul4C and two Java tools on Vul4J, is that semantics-based patch generation methods (ExtractFix, Senx, VulnFix), which derive patches from violated security constraints, outperform learning-based methods (VRepair, VulRepair, VQM, VulMaster) on patch restoration, compilation, and test-pass rates, with VulnFix reaching a 96.0% test-pass rate. The paper additionally reports that none of the tools reliably produces patches equivalent to the human-written ground truth — success rates range from 0% to 10.4% — and that plausible patches from semantics-based tools can still serve as temporary mitigations for developers.

Load-bearing premise

The comparison at the heart of the paper assumes that percentages computed on different vulnerability subsets are comparable: the four learning-based tools were tested on 81 single-file vulnerabilities, while semantics-based tools were tested on 69 to 135 vulnerabilities selected by different vulnerability types and compiler constraints, so a difference in average difficulty between these subsets could produce the reported ranking by itself.

Editorial extensions

If this is right

  • Vul4C gives the AVR community a common yardstick: 144 real-world C/C++ vulnerabilities, each with an exploit, a patch, trigger inputs, and sanitizer outputs, so future tools can be compared on identical ground rather than ad hoc datasets.
  • On this benchmark, semantics-based patch generation produces more compilable and more test-passing patches than learning-based generation, whose weakness is placing generated code, not writing it.
  • Even the best tool rarely matches the human patch — success rates top out near 10% — so current AVR tools cannot yet be trusted to fix vulnerabilities end-to-end.
  • Plausible patches from semantics-based tools, though usually not fully correct, contain the security-check conditions of the human patch and can serve as temporary mitigations for developers.
  • Statement-level vulnerability localization accuracy is below 32% for the tools tested, making localization, not patch synthesis, the limiting step of the AVR workflow.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A matched-pair evaluation — each tool scored on exactly the same vulnerabilities — would settle whether the paper's ordering of semantics-based over learning-based tools survives; the paper's own tables show the two families were tested on different subsets, so the ranking is a claim the reader should hold lightly.
  • The construction filters (working reference links, reproducible sanitizer-triggering exploits) skew Vul4C toward memory-safety bugs with public proof-of-concept inputs; results may not transfer to logic flaws, configuration errors, or vulnerabilities requiring complex multi-step triggering.
  • VulnFix's plausible patches, which the paper shows often contain the same conditions as human patches but terminate or return instead, point toward a division of labor: automated tools generate patch conditions and developers choose how to integrate them, rather than AVR aiming for end-to-end identical patches.
  • The learning-based tools' dominant failure mode is patch placement, not synthesis; injecting a localization step ahead of generation — the paper's own first research direction — is a concrete, testable way to close most of the gap identified in the study.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper systematizes automated vulnerability repair (AVR) into three workflow steps (vulnerability analysis, patch generation, patch validation), reviews 64 AVR tools from 70 papers, constructs a new C/C++ vulnerability repair benchmark named Vul4C (144 real-world vulnerabilities with exploits and patches), evaluates seven C/C++ AVR tools and two Java AVR tools, and additionally evaluates four APR tools as a side product. The main empirical claims are that semantics-based patch generation outperforms learning-based patch generation on Vul4C, that learning-based AVR tools lack rigorous evaluation methodologies, and that plausible patches from semantics-based tools can serve as temporary mitigations. The paper also proposes a research roadmap for future AVR work.

Significance. The benchmark construction is a genuine service to the community: vulnerabilities were rebuilt, exploits were re-triggered under sanitizers, non-exploitable cases were removed, and the resulting dataset of 144 real-world C/C++ vulnerabilities across 23 products and 19 CWE types is released with code and experimental data. The systematization of 64 tools is broad and the failure analysis is often informative. If the headline comparative finding were valid, the paper would be an important reference point for AVR evaluation. However, the central empirical comparison underlying Insight 2 is confounded by disjoint evaluation subsets and inconsistent denominators, so the significance of the paper currently depends on a revised analysis or a substantially weakened claim.

major comments (3)
  1. [Section 6, Table 2, Abstract and Section 1] Insight 2 is not established by the presented data. The learning-based tools are evaluated on 81 single-file vulnerabilities with 50 candidate patches each (4,050 candidates), whereas the semantics-based tools are evaluated on different applicable sets (VulnFix on 135, Senx on 85, ExtractFix on 69) and produced only 25, 19, and 16 candidate patches in total, respectively. Table 7 shows that semantics-based tools fail to generate any candidate patch for 77.65%–82.61% of their applicable vulnerabilities, so their high test-pass rates (e.g., VulnFix at 96.0%, 24/25) are conditional on the small subset where generation succeeded. The paper itself documents the applicability constraints in Section 7.1 and Table 3, but Insight 2 nonetheless compares the aggregate percentages across these different denominators. No common-subset analysis, per-vulnerability success rate using the applicable-vulnerability denominator, or statistical significance test is provided. This is load-bearing because the semantics-versus-learning ranking is a headline contribution; the conclusion should be re-derived on a comparable basis or appropriately weakened.
  2. [Section 7.1, Section 6 Step 4] The claim that Vul4C is "the first C/C++ vulnerability repair benchmark dataset" is contradicted by the paper's own Table 2, which lists ExtractFix [38] and VulnLoc [106] as existing real-world program-level C/C++ datasets with exploits, patches, and 100% ground-truth coverage, albeit with fewer vulnerabilities. The novelty of Vul4C lies in its scale, breadth, and completeness (144 vulnerabilities, 23 products, 19 CWE types), not in being first. This overclaim should be corrected by reframing the contribution as the largest or most comprehensive benchmark of its kind.
  3. [Minor comments] The definition of test pass rate depends on both exploit-triggering tests and functional test cases, but Section 6 Step 4 reports that test cases are available for only 11 of the 23 software products (Table 2 lists testability as 47%, i.e., 68/144). The paper does not state how the metric is computed for vulnerabilities whose products lack test suites, nor whether the analysis is restricted to the 68 vulnerabilities with test cases. Because the aggregate rates in Table 5 are central to the comparison, this ambiguity should be resolved and the rates recomputed with an explicitly defined denominator.
minor comments (5)
  1. [Table 13 and Section E.1] The column headers for the two C/C++ APR tools incorrectly cite the references: "CquenceR [146]" should be CquenceR [94], and "NTR [18]" should be NTR [48]. The same error appears in the prose of Section E.1.
  2. [Table 5] The ExtractFix row contains a typo: "18.8% (3/16))" has an extra closing parenthesis.
  3. [Section 7.2.2] The sentence referring to "detailed results ... in Appendix D" is imprecise; the per-vulnerability results are in Tables 14 and 15, while much of Appendix D consists of case studies. Please point the reader to the exact tables.
  4. [Ethics Considerations] The sentence "We thank the anonymous reviewers for their insightful comments" is duplicated from the Acknowledgements and should be removed from the Ethics Considerations section.
  5. [Appendix D.4.7] The text attributes the candidate patch for CVE-2016-9828 to VulRepair [34], but the caption of Listing 17 attributes it to VRepair [34]. Please correct the attribution to eliminate the inconsistency.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the benchmark construction and tool evaluations are grounded in external datasets and independent measurements; self-citations are not load-bearing.

full rationale

VUL4C is assembled from external sources (the ExtractFix, LinuxFlaw, PatchWeave, and VulnLoc datasets, a re-collected Senx dataset, online proof-of-concept exploits, and NVD vulnerabilities from 2010-2023), with exploitability re-tested via sanitizers and patches collected from NVD reference links. No benchmark entry is defined in terms of a tool's evaluation outcome, and no AVR tool parameter is fitted to VUL4C before evaluation; learning-based tools are trained on Big-Vul plus CVEfixes with VUL4C duplicates removed. The central comparison (Insight 2) is an empirical measurement subject to a real methodological confound: tools run on different applicability subsets (81, 69, 85, and 135 vulnerabilities, per Table 3) and rates use different candidate-patch denominators (4,050 vs. 25, 16, and 19, per Table 5). This may make the semantics-versus-learning gap an artifact of subset selection and conditional success, but that is an evaluation-validity threat, not circular reasoning: the conclusion does not reduce to an input by construction. The paper itself discloses these differing subsets in Section 7.1 and in the applicability column of Table 3. Self-citations (Refs. 60 and 61) support contextual claims about cross-function vulnerabilities and learning-based detection in a future-directions discussion; neither is the load-bearing premise of VUL4C or of the empirical ranking. No uniqueness theorem, ansatz-by-citation, or renaming of known results was found, so the derivation chain is self-contained with respect to circularity.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The empirical claims rest on the benchmark construction choices and the comparability of tool subsets, not on fitted parameters or new postulated entities.

assumptions (5)
  • domain assumption Sanitizer reports (ASAN, UBSAN, Low-fat) are treated as evidence that a vulnerability can be triggered.
    Used in Step 3 of Section 6 to eliminate 34 non-exploitable vulnerabilities; if sanitizer reports do not correspond to real exploits, some Vul4C entries are mislabeled.
  • domain assumption Human-crafted ground-truth patches in Vul4C are correct and semantically complete.
    Defines the consistency and success rates in Section 7.1; incorrect ground truth would bias the reported success rates.
  • domain assumption Co-author manual judgment of semantic equivalence is reliable and unbiased.
    The success rate metric in Section 7.1 is computed by the authors themselves without a second independent annotator or reported agreement metric.
  • domain assumption Aggregate accuracy rates computed over different vulnerability subsets are comparable across tools.
    Table 5 and Insight 2 compare tools evaluated on different subsets (Table 3); this assumes subset difficulty is comparable.
  • domain assumption The test pass rate, measured with exploits and available test cases, is a meaningful proxy for patch quality.
    Used throughout Section 7; only 11 of 23 Vul4C products had test modules (Section 6 Step 4), so test coverage is incomplete.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Automated Vulnerability Repair: Methods, Tools, and Assessments." pith.science (2026). https://pith.science/paper/HNC4QP6O

@misc{pith2026250611697,
  author       = {Pith},
  title        = {Pith review of: SoK: Automated Vulnerability Repair: Methods, Tools, and Assessments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HNC4QP6O}},
  note         = {Machine review of arXiv:2506.11697}
}
read the original abstract

The increasing complexity of software has led to the steady growth of vulnerabilities. Vulnerability repair investigates how to fix software vulnerabilities. Manual vulnerability repair is labor-intensive and time-consuming because it relies on human experts, highlighting the importance of Automated Vulnerability Repair (AVR). In this SoK, we present the systematization of AVR methods through the three steps of AVR workflow: vulnerability analysis, patch generation, and patch validation. We assess AVR tools for C/C++ and Java programs as they have been widely studied by the community. Since existing AVR tools for C/C++ programs are evaluated with different datasets, which often consist of a few vulnerabilities, we construct the first C/C++ vulnerability repair benchmark dataset, dubbed Vul4C, which contains 144 vulnerabilities as well as their exploits and patches. We use Vul4C to evaluate seven AVR tools for C/C++ programs and use the third-party Vul4J dataset to evaluate two AVR tools for Java programs. We also discuss future research directions.

Figures

Figures reproduced from arXiv: 2506.11697 by the authors.

Figure 1
Figure 1. AVR workflow (three steps) paths; (iv) statistical analysis, which leverages statistical fea￾tures to identify correlations. Automated patch generation. This step generates one or multiple candidate patches for a given vulnerability. There are four approaches: (i) search-based, which searches candi￾date patches in a pre-defined patch space; (ii) template-based, which leverages abstract patch templates; (iii) semanti… view at source ↗
Figure 2
Figure 2. Characterizing the 64 AVR tool through AVR workflow: vulnerability analysis, patch generation, and patch validation [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. VulnRepairEval: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities

    cs.SE 2025-09 conditional novelty 6.0 of 10

    A benchmark that requires a patch to block a working exploit finds the best LLM repairs only 21.7% of 23 real CVEs, with most failures caused by missed localization and malformed patches.

Reference graph

Works this paper leans on

155 extracted references · 77 canonical work pages · cited by 1 Pith paper

  1. [38]

    Duck, Ruyi Ji, Yingfei Xiong, and Abhik Roychoudhury

    Xiang Gao, Bo Wang, Gregory J. Duck, Ruyi Ji, Yingfei Xiong, and Abhik Roychoudhury. Beyond tests: Program vulnerability repair via crash constraint extraction.ACM Transactions on Software Engineer- ing and Methodology (TOSEM), 30(2):1–27, 2021

    2021

  2. [106]

    Localizing vulnera- bilities statistically from one exploit

    Shiqi Shen, Aashish Kolluri, Zhen Dong, Prateek Sax- ena, and Abhik Roychoudhury. Localizing vulnera- bilities statistically from one exploit. InProceedings of the 2021 ACM Asia Conference on Computer and Communications Security (AsiaCCS), Virtual Event, Hong Kong, page 537–549, 2021

    work page 2021

  3. [1]

    https: //github.com/gsliepen/tinc/commit/ 17a33dfd95b1a29e90db76414eb9622df9632320

    Developer patch for cve-2013-1428. https: //github.com/gsliepen/tinc/commit/ 17a33dfd95b1a29e90db76414eb9622df9632320

    2013

  4. [2]

    https://git.kernel.org/pub/scm/linux/ kernel/git/stable/linux.git/commit/?id= 81137162bfaa7278785b24c1fd2e9e74f082e8e4

    Developer patch for cve-2024-26889. https://git.kernel.org/pub/scm/linux/ kernel/git/stable/linux.git/commit/?id= 81137162bfaa7278785b24c1fd2e9e74f082e8e4

    2024

  5. [3]

    Fault- localization techniques for software systems: A liter- ature review.ACM SIGSOFT Software Engineering Notes, 39(5):1–8, 2014

    Pragya Agarwal and Arun Prakash Agrawal. Fault- localization techniques for software systems: A liter- ature review.ACM SIGSOFT Software Engineering Notes, 39(5):1–8, 2014

    2014

  6. [4]

    asarubbo/poc

    Asarubbo. asarubbo/poc. https://github.com/ asarubbo/poc, 2023

    2023

  7. [5]

    Josh Berdine, Cristiano Calcagno, and Peter W. O’Hearn. Symbolic execution with separation logic. InProceedings of the Third Asian Conference on Pro- gramming Languages and Systems (APLAS), Tsukuba, Japan, pages 52–68, 2005. 14

    2005

  8. [6]

    CVEfixes: Automated collection of vulnerabilities and their fixes from open-source software

    Guru Bhandari, Amara Naseer, and Leon Moonen. CVEfixes: Automated collection of vulnerabilities and their fixes from open-source software. InProceed- ings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering (PROMISE), Athens, Greece, pages 30–39, 2021

    2021

Show all 155 references
  1. [7]

    Aurora: statistical crash analysis for au- tomated root cause explanation

    Tim Blazytko, Moritz Schlögel, Cornelius Ascher- mann, Ali Abbasi, Joel Frank, Simon Wörner, and Thorsten Holz. Aurora: statistical crash analysis for au- tomated root cause explanation. InProceedings of the 29th USENIX Security Symposium (USENIX Security), USA, 2020

    2020

  2. [8]

    Apr4vul: an empirical study of automatic program repair tech- niques on real-world java vulnerabilities.Empirical Software Engineering (ESE), 29(18):1–40, 2024

    Quang-Cuong Bui, Ranindya Paramitha, Duc-Ly Vu, Fabio Massacci, and Riccardo Scandariato. Apr4vul: an empirical study of automatic program repair tech- niques on real-world java vulnerabilities.Empirical Software Engineering (ESE), 29(18):1–40, 2024

    2024

  3. [9]

    Díaz Ferreyra

    Quang-Cuong Bui, Riccardo Scandariato, and Nicolás E. Díaz Ferreyra. Vul4J: A dataset of reproducible java vulnerabilities geared towards the study of program repair techniques. InProceedings of the 19th Inter- national Conference on Mining Software Repositories (MSR), Pittsbu...

    2022

  4. [10]

    End-to-end object detection with trans- formers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with trans- formers. InProceedings ot the 2020 European Con- ference on Computer Vision (ECCV), Glasgow, United Kingdom, pages 213–229, 2020

    2020

  5. [11]

    Safes- tack: Automatically patching stack-based buffer over- flow vulnerabilities.IEEE Transactions on Depend- able and Secure Computing (TDSC), 10(6):368–379, 2013

    Gang Chen, Hai Jin, Deqing Zou, Bing Bing Zhou, Zhenkai Liang, Weide Zheng, and Xuanhua Shi. Safes- tack: Automatically patching stack-based buffer over- flow vulnerabilities.IEEE Transactions on Depend- able and Secure Computing (TDSC), 10(6):368–379, 2013

    2013

  6. [12]

    Diversevul: A new vul- nerable source code dataset for deep learning based vulnerability detection

    Yizheng Chen, Zhoujie Ding, Lamya Alowain, Xinyun Chen, and David Wagner. Diversevul: A new vul- nerable source code dataset for deep learning based vulnerability detection. InProceedings of the 26th In- ternational Symposium on Research in Attacks, Intru- sions and Defenses (...

    2023

  7. [13]

    Adaptive android kernel live patching

    Yue Chen, Yulong Zhang, Zhi Wang, Liangzhao Xia, Chenfu Bao, and Tao Wei. Adaptive android kernel live patching. InProceedings of the 26th USENIX Security Symposium (USENIX Security), Vancouver, BC, Canada, pages 1253–1270, 2017

    2017

  8. [14]

    Neural transfer learning for repairing security vulner- abilities in c code.IEEE Transactions on Software Engineering (TSE), 49(1):147–165, 2023

    Zimin Chen, Steve Kommrusch, and Martin Monperrus. Neural transfer learning for repairing security vulner- abilities in c code.IEEE Transactions on Software Engineering (TSE), 49(1):147–165, 2023

    2023

  9. [15]

    Sequencer: Sequence-to-sequence learn- ing for end-to-end program repair.IEEE Transactions on Software Engineering (TSE), 47(09):1943–1959, 2021

    Zimin Chen, Steve Kommrusch, Michele Tufano, Louis-Noel Pouchet, Denys Poshyvanyk, and Martin Monperrus. Sequencer: Sequence-to-sequence learn- ing for end-to-end program repair.IEEE Transactions on Software Engineering (TSE), 47(09):1943–1959, 2021

    1943

  10. [16]

    Intpti: Automatic integer error repair with proper-type inference

    Xi Cheng, Min Zhou, Xiaoyu Song, Ming Gu, and Jiaguang Sun. Intpti: Automatic integer error repair with proper-type inference. InProceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE), Urbana, IL, USA, pages 996–1001, 2017

    2017

  11. [17]

    Tolerating c integer error via precision elevation.IEEE Transactions on Computers (TC), 68(2):270–286, 2019

    Xi Cheng, Min Zhou, Xiaoyu Song, Ming Gu, and Jiaguang Sun. Tolerating c integer error via precision elevation.IEEE Transactions on Computers (TC), 68(2):270–286, 2019

    2019

  12. [18]

    Seqtrans: Automatic vulnerability fix via sequence to sequence learning.IEEE Transactions on Software Engineering (TSE), 49(2):564–585, 2023

    Jianlei Chi, Yu Qu, Ting Liu, Qinghua Zheng, and Heng Yin. Seqtrans: Automatic vulnerability fix via sequence to sequence learning.IEEE Transactions on Software Engineering (TSE), 49(2):564–585, 2023

    2023

  13. [19]

    Repairing DoS vulnerability of real-world regexes

    Nariyoshi Chida and Tachio Terauchi. Repairing DoS vulnerability of real-world regexes. InProceedings of the 43rd IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA, pages 2060–2077, 2022

    2022

  14. [20]

    Routing in undirected graphs with constant congestion

    Julia Chuzhoy. Routing in undirected graphs with constant congestion. InProceedings of the Forty- Fourth Annual ACM Symposium on Theory of Comput- ing (STOC), New York, New York, USA, page 855–874, 2012

    2012

  15. [21]

    Program transforma- tions to fix C integers

    Zack Coker and Munawar Hafiz. Program transforma- tions to fix C integers. InProceedings of the 35th Inter- national Conference on Software Engineering (ICSE), San Francisco, CA, USA, page 792–801, 2013

    2013

  16. [22]

    ConsenSysDiligence. mythril. https://github. com/ConsenSys/mythril

  17. [23]

    Pentestgpt: Eval- uating and harnessing large language models for au- tomated penetration testing

    Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. Pentestgpt: Eval- uating and harnessing large language models for au- tomated penetration testing. InProceedings of the 33rd USENIX Security Sym...

    2024

  18. [24]

    Automating patching of vulnera- ble open-source software versions in application bi- naries

    Ruian Duan, Ashish Bijlani, Yang Ji, Omar Alrawi, Yiyuan Xiong, Moses Ike, Brendan Saltaformaggio, and Wenke Lee. Automating patching of vulnera- ble open-source software versions in application bi- naries. InProceedings of the 26th Annual Network and Distributed System Securi...

    2019

  19. [25]

    Duck, Xiang Gao, and Abhik Roychoud- hury

    Gregory J. Duck, Xiang Gao, and Abhik Roychoud- hury. Binary rewriting without control flow recovery. InProceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementa- tion (PLDI), London, UK, page 151–163, 2020

    2020

  20. [26]

    Duck and Roland H

    Gregory J. Duck and Roland H. C. Yap. Heap bounds protection with low fat pointers. InProceedings of the 25th International Conference on Compiler Construc- tion (CC), Barcelona, Spain, pages 132–142, 2016

    2016

  21. [27]

    Stack bounds protection with low fat point- ers

    Gregory J Duck, Roland HC Yap, and Lorenzo Cav- allaro. Stack bounds protection with low fat point- ers. InProceedings of the 24th Annual Network and Distributed System Security Symposium (NDSS), San Diego, California, USA, 2017

    2017

  22. [28]

    Dynamic patch generation for null pointer exceptions using metaprogramming

    Thomas Durieux, Benoit Cornu, Lionel Seinturier, and Martin Monperrus. Dynamic patch generation for null pointer exceptions using metaprogramming. InPro- ceedings of the 2017 IEEE 24th International Con- ference on Software Analysis, Evolution and Reengi- neering (SANER), Klag...

    2017

  23. [29]

    Icore con- ference portal

    Computing Research & Education. Icore con- ference portal. https://portal.core.edu.au/ conf-ranks/, 2025

    2025

  24. [30]

    Facebook infer

    Facebook. Facebook infer. https://fbinfer.com/, 2024

    2024

  25. [31]

    Jiahao Fan, Yi Li, Shaohua Wang, and Tien N. Nguyen. A C/C++ code vulnerability dataset with code changes and cve summaries. InProceedings of the 17th Inter- national Conference on Mining Software Repositories (MSR), Seoul, Republic of Korea, pages 508–512, 2020

    2020

  26. [32]

    Elysium: Context-aware bytecode-level patching to automatically heal vulnerable smart contracts

    Christof Ferreira Torres, Hugo Jonker, and Radu State. Elysium: Context-aware bytecode-level patching to automatically heal vulnerable smart contracts. InPro- ceedings of the 25th International Symposium on Re- search in Attacks, Intrusions and Defenses (RAID), Li- massol, Cyp...

    2022

  27. [33]

    Vision transformer inspired automated vulnerability repair.ACM Transactions on Software Engineering and Methodology (TOSEM), 33(3):1–29, 2024

    Michael Fu, Van Nguyen, Chakkrit Tantithamthavorn, Dinh Phung, and Trung Le. Vision transformer inspired automated vulnerability repair.ACM Transactions on Software Engineering and Methodology (TOSEM), 33(3):1–29, 2024

    2024

  28. [34]

    Vulrepair: A t5-based auto- mated software vulnerability repair

    Michael Fu, Chakkrit Tantithamthavorn, Trung Le, Van Nguyen, and Dinh Phung. Vulrepair: A t5-based auto- mated software vulnerability repair. InProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Soft- ware Engineering...

    2022

  29. [35]

    Bovinspector: Automatic inspection and repair of buffer overflow vulnerabilities

    Fengjuan Gao, Linzhang Wang, and Xuandong Li. Bovinspector: Automatic inspection and repair of buffer overflow vulnerabilities. InProceedings of the 31st IEEE/ACM International Conference on Auto- mated Software Engineering (ASE), Singapore, Singa- pore, page 786–791, 2016

    2016

  30. [36]

    Safe memory-leak fixing for C programs

    Qing Gao, Yingfei Xiong, Yaqing Mi, Lu Zhang, Weikun Yang, Zhaoping Zhou, Bing Xie, and Hong Mei. Safe memory-leak fixing for C programs. In Proceedings of the 37th International Conference on Software Engineering (ICSE), Florence, Italy, page 459–470. IEEE, 2015

    2015

  31. [37]

    Crash-avoiding program repair

    Xiang Gao, Sergey Mechtaev, and Abhik Roychoud- hury. Crash-avoiding program repair. InProceed- ings of the 28th ACM SIGSOFT International Sympo- sium on Software Testing and Analysis (ISSTA), Beijing, China, page 8–18, 2019

    2019

  32. [39]

    Automatic software repair: A survey.IEEE Transac- tions on Software Engineering (TSE), 45(01):34–67, 2019

    Luca Gazzola, Daniela Micucci, and Leonardo Mariani. Automatic software repair: A survey.IEEE Transac- tions on Software Engineering (TSE), 45(01):34–67, 2019

    2019

  33. [40]

    github. Codeql. https://codeql.github.com/, 2024

    2024

  34. [41]

    Generative adver- sarial networks.Communications of the ACM, 63(11):139–144, 2020

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adver- sarial networks.Communications of the ACM, 63(11):139–144, 2020

    2020

  35. [42]

    Perception and practices of differential testing

    Muhammad Ali Gulzar, Yongkang Zhu, and Xiaofeng Han. Perception and practices of differential testing. In Proceedings of the 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engi- neering in Practice (ICSE-SEIP), Montreal, Quebec, Canada, pages 71–80, 2019

    2019

  36. [43]

    Learning to repair software vulnerabilities with generative adversarial networks

    Jacob Harer, Onur Ozdemir, Tomo Lazovich, Christo- pher Reale, Rebecca Russell, Louis Kim, and Peter 16 Chin. Learning to repair software vulnerabilities with generative adversarial networks. InProceedings of the 2018 Annual Conference on Neural Information Pro- cessing System...

    2018

  37. [44]

    SA VER: Scalable, precise, and safe memory-error repair

    Seongjoon Hong, Junhee Lee, Jeongsoo Lee, and Hakjoo Oh. SA VER: Scalable, precise, and safe memory-error repair. InProceedings of the ACM/IEEE 42nd International Conference on Software Engineer- ing (ICSE), Seoul, South Korea, page 271–283, 2020

    2020

  38. [45]

    Large language models for soft- ware engineering: A systematic literature review.ACM Transactions on Software Engineering and Methodol- ogy (TOSEM), 33(8):1–79, 2024

    Xinyi Hou, Yanjie Zhao, Yue Liu, Zhou Yang, Kai- long Wang, Li Li, Xiapu Luo, David Lo, John Grundy, and Haoyu Wang. Large language models for soft- ware engineering: A systematic literature review.ACM Transactions on Software Engineering and Methodol- ogy (TOSEM), 33(8):1–79, 2024

    2024

  39. [46]

    Rupair: Towards auto- matic buffer overflow detection and rectification for rust

    Baojian Hua, Wanrong Ouyang, Chengman Jiang, Qil- iang Fan, and Zhizhong Pan. Rupair: Towards auto- matic buffer overflow detection and rectification for rust. InProceedings of the 37th Annual Computer Secu- rity Applications Conference (ACSAC), Virtual Event, USA, page 812–823, 2021

    2021

  40. [47]

    Evolving paradigms in automated program repair: Taxonomy, challenges, and opportunities.ACM Computing Sur- veys (CSUR), 57(2):1–43, 2024

    Kai Huang, Zhengzi Xu, Su Yang, Hongyu Sun, Xue- jun Li, Zheng Yan, and Yuqing Zhang. Evolving paradigms in automated program repair: Taxonomy, challenges, and opportunities.ACM Computing Sur- veys (CSUR), 57(2):1–43, 2024

    2024

  41. [48]

    Template-guided program repair in the era of large language models

    Kai Huang, Jian Zhang, Xiangxin Meng, and Yang Liu. Template-guided program repair in the era of large language models. InProceedings of the 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), Ottawa, ON, Canada, pages 367– 379, 2025

    2025

  42. [49]

    Using safety properties to generate vulnerability patches

    Zhen Huang, David Lie, Gang Tan, and Trent Jaeger. Using safety properties to generate vulnerability patches. InProceedings of the 2019 IEEE Sympo- sium on Security and Privacy (S&P), San Francisco, CA, USA, pages 539–554, 2019

    2019

  43. [50]

    Automatic patch generation learned from human-written patches

    Dongsun Kim, Jaechang Nam, Jaewoo Song, and Sunghun Kim. Automatic patch generation learned from human-written patches. InProceedings of the 2013 35th International Conference on Software Engi- neering (ICSE), San Francisco, CA, USA, pages 802– 811, 2013

    2013

  44. [51]

    Genetic programming: on the program- ming of computers by means of natural selection cam- bridge.MA: MIT Press, 4:87–112, 1992

    John R Koza. Genetic programming: on the program- ming of computers by means of natural selection cam- bridge.MA: MIT Press, 4:87–112, 1992

    1992

  45. [52]

    A case study of llm for auto- mated vulnerability repair: Assessing impact of reason- ing and patch validation feedback

    Ummay Kulsum, Haotian Zhu, Bowen Xu, and Marcelo d’Amorim. A case study of llm for auto- mated vulnerability repair: Assessing impact of reason- ing and patch validation feedback. InProceedings of the 1st ACM International Conference on AI-Powered Software (AIware), Porto de G...

    2024

  46. [53]

    Verismart: a formal verification tool for so- lidity smart contracts

    kupl. Verismart: a formal verification tool for so- lidity smart contracts. https://github.com/kupl/ VeriSmart-public

  47. [54]

    Genprog: A generic method for automatic software repair.IEEE Transactions on Software Engineering (TSE), 38(1):54–72, 2012

    Claire Le Goues, ThanhVu Nguyen, Stephanie Forrest, and Westley Weimer. Genprog: A generic method for automatic software repair.IEEE Transactions on Software Engineering (TSE), 38(1):54–72, 2012

    2012

  48. [55]

    Mem- Fix: Static analysis-based repair of memory dealloca- tion errors for C

    Junhee Lee, Seongjoon Hong, and Hakjoo Oh. Mem- Fix: Static analysis-based repair of memory dealloca- tion errors for C. InProceedings of the 26th ACM Joint Meeting on European Software Engineering Confer- ence and Symposium on the Foundations of Software Engineering (ESEC/FSE...

    2018

  49. [56]

    NPEX: Repairing Java null pointer exceptions without tests

    Junhee Lee, Seongjoon Hong, and Hakjoo Oh. NPEX: Repairing Java null pointer exceptions without tests. InProceedings of the 44th International Conference on Software Engineering (ICSE), Pittsburgh, Pennsyl- vania, page 1532–1544, 2022

    2022

  50. [57]

    Retrieval-augmented generation for knowledge- intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks. InProceedings of the 34th Interna- tional Confer...

    2020

  51. [58]

    Regexscalpel: Reg- ular expression denial of service (redos) defense by localize-and-fix

    Yeting Li, Yecheng Sun, Zhiwu Xu, Jialun Cao, Yuekang Li, Rongchen Li, Haiming Chen, Shing-Chi Cheung, Yang Liu, and Yang Xiao. Regexscalpel: Reg- ular expression denial of service (redos) defense by localize-and-fix. InProceedings of the 31st USENIX Security Symposium (USENIX...

    2022

  52. [59]

    SoK: Towards effective automated vulnerability repair.arXiv preprint arXiv:2501.18820, 2025

    Ying Li, Faysal Hossain Shezan, Bomin Wei, Gang Wang, and Yuan Tian. SoK: Towards effective automated vulnerability repair.arXiv preprint arXiv:2501.18820, 2025

    2025 arXiv

  53. [60]

    On the effectiveness of function-level vulnerability detectors for inter-procedural vulnerabilities

    Zhen Li, Ning Wang, Deqing Zou, Yating Li, Ruqian Zhang, Shouhuai Xu, Chao Zhang, and Hai Jin. On the effectiveness of function-level vulnerability detectors for inter-procedural vulnerabilities. InProceedings 17 of the IEEE/ACM 46th International Conference on Software Engine...

    2024

  54. [61]

    Vuldeelocator: A deep learning-based fine-grained vulnerability detector

    Zhen Li, Deqing Zou, Shouhuai Xu, Zhaoxuan Chen, Yawei Zhu, and Hai Jin. Vuldeelocator: A deep learning-based fine-grained vulnerability detector. IEEE Transactions on Dependable and Secure Com- puting (TDSC), 19(4):2821–2837, 2021

    2021

  55. [62]

    One size does not fit all: Multi- granularity patch generation for better automated pro- gram repair

    Bo Lin, Shangwen Wang, Ming Wen, Liqian Chen, and Xiaoguang Mao. One size does not fit all: Multi- granularity patch generation for better automated pro- gram repair. InProceedings of the 33rd ACM SIG- SOFT International Symposium on Software Testing and Analysis (ISSTA), Vien...

    2024

  56. [63]

    Autopag: Towards automated software patch generation with source code root cause identi- fication and repair

    Zhiqiang Lin, Xuxian Jiang, Dongyan Xu, Bing Mao, and Li Xie. Autopag: Towards automated software patch generation with source code root cause identi- fication and repair. InProceedings of the 2nd ACM Symposium on Information, Computer and Commu- nications Security (AsiaCCS), ...

    2007

  57. [64]

    Exploring chatgpt’s capabilities on vulnerability management

    Peiyu Liu, Junming Liu, Lirong Fu, Kangjie Lu, Yi- fan Xia, Xuhong Zhang, Wenzhi Chen, Haiqin Weng, Shouling Ji, and Wenhai Wang. Exploring chatgpt’s capabilities on vulnerability management. InPro- ceedings of the 33rd USENIX Security Symposium (USENIX Security), Philadelphia...

    2024

  58. [65]

    Program repair guided by datalog- defined static analysis

    Yu Liu, Sergey Mechtaev, Pavle Suboti´c, and Abhik Roychoudhury. Program repair guided by datalog- defined static analysis. InProceedings of the 31st ACM Joint European Software Engineering Confer- ence and Symposium on the Foundations of Software Engineering, San Francisco (E...

    2023

  59. [66]

    Undefinedbehaviorsanitizer

    LLVM. Undefinedbehaviorsanitizer. https://clang. llvm.org/docs/UndefinedBehaviorSanitizer. html, 2024

    2024

  60. [67]

    SoK: Security of programmable logic controllers

    Efrén López-Morales, Ulysse Planta, Carlos Rubio- Medrano, Ali Abbasi, and Alvaro A Cardenas. SoK: Security of programmable logic controllers. InPro- ceedings of the 33rd USENIX Security Symposium (USENIX Security), pages 7103–7122, 2024

    2024

  61. [68]

    Making smart contracts smarter

    Loi Luu, Duc-Hiep Chu, Hrishi Olickel, Prateek Sax- ena, and Aquinas Hobor. Making smart contracts smarter. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Secu- rity (CCS), Vienna, Austria, page 254–269, 2016

    2016

  62. [69]

    Siqi Ma, David Lo, Teng Li, and Robert H. Deng. Cdrep: Automatic repair of cryptographic misuses in android applications. InProceedings of the 11th ACM on Asia Conference on Computer and Communica- tions Security (AsiaCCS), Xi’an, China, page 711–722, 2016

    2016

  63. [70]

    Vurle: Automatic vulnerability detec- tion and repair by learning from examples

    Siqi Ma, Ferdian Thung, David Lo, Cong Sun, and Robert H Deng. Vurle: Automatic vulnerability detec- tion and repair by learning from examples. InProceed- ings of 2017 Computer Security-European Symposium on Research in Computer Security (ESORICS), Oslo, Norway, pages 229–246, 2017

    2017

  64. [71]

    Symbolic execution with existential second-order constraints

    Sergey Mechtaev, Alberto Griggio, Alessandro Cimatti, and Abhik Roychoudhury. Symbolic execution with existential second-order constraints. InProceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software...

    2018

  65. [72]

    Angelix: scalable multiline program patch syn- thesis via symbolic analysis

    Sergey Mechtaev, Jooyong Yi, and Abhik Roychoud- hury. Angelix: scalable multiline program patch syn- thesis via symbolic analysis. InProceedings of the 38th International Conference on Software Engineer- ing (ICSE), Austin, Texas, page 691–701, 2016

    2016

  66. [73]

    Large language model guided protocol fuzzing

    Ruijie Meng, Martin Mirchev, Marcel Böhme, and Ab- hik Roychoudhury. Large language model guided protocol fuzzing. InProceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, 2024

    2024

  67. [74]

    Cohen, and Justyna Petke

    Ibrahim Mesecan, Daniel Blackwell, David Clark, Myra B. Cohen, and Justyna Petke. Hypergi: Auto- mated detection and repair of information flow leakage. InProceedings of the 2021 36th IEEE/ACM Interna- tional Conference on Automated Software Engineering (ASE), Melbourne, Austr...

    2021

  68. [75]

    Vulchecker: Graph-based vulnerability localization in source code

    Yisroel Mirsky, George Macon, Michael Brown, Carter Yagemann, Matthew Pruett, Evan Downing, Sukarno Mertoguno, and Wenke Lee. Vulchecker: Graph-based vulnerability localization in source code. InPro- ceedings of the 32nd USENIX Security Symposium (USENIX Security), Anaheim, CA...

    2023

  69. [76]

    Common weakness enumeration

    MITRE. Common weakness enumeration. https: //cwe.mitre.org/, 2025

    2025

  70. [77]

    Automatic software repair: A bib- liography.ACM Computing Surveys (CSUR), 51(1):1– 24, 2018

    Martin Monperrus. Automatic software repair: A bib- liography.ACM Computing Surveys (CSUR), 51(1):1– 24, 2018. 18

    2018

  71. [78]

    PhD thesis, HAL Archives Ouvertes, 2018

    Martin Monperrus.The Living Review on Automated Program Repair. PhD thesis, HAL Archives Ouvertes, 2018

    2018

  72. [79]

    Under- standing the reproducibility of crowd-reported security vulnerabilities

    Dongliang Mu, Alejandro Cuevas, Limin Yang, Hang Hu, Xinyu Xing, Bing Mao, and Gang Wang. Under- standing the reproducibility of crowd-reported security vulnerabilities. InProceedings of the 27th USENIX Se- curity Symposium (USENIX Security), Baltimore, MD, USA, pages 919–936, 2018

    2018

  73. [80]

    Intrepair: Informed repairing of integer overflows.IEEE Transactions on Software Engineering (TSE), 47(10):2225–2241, 2019

    Paul Muntean, Martin Monperrus, Hao Sun, Jens Grossklags, and Claudia Eckert. Intrepair: Informed repairing of integer overflows.IEEE Transactions on Software Engineering (TSE), 47(10):2225–2241, 2019

    2019

  74. [81]

    Nguyen, Long H

    Tai D. Nguyen, Long H. Pham, and Jun Sun. Sguard: Towards fixing vulnerable smart contracts automati- cally. InProceedings of the 2021 IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA, pages 1215–1229, 2021

    2021

  75. [82]

    Megavul: A c/c++ vulnerability dataset with comprehensive code representations

    Chao Ni, Liyu Shen, Xiaohu Yang, Yan Zhu, and Shao- hua Wang. Megavul: A c/c++ vulnerability dataset with comprehensive code representations. InProceed- ings of the 21st International Conference on Mining Software Repositories (MSR), Lisbon, Portugal, page 738–742, 2024

    2024

  76. [83]

    Crossvul: a cross- language vulnerability dataset with commit data

    Georgios Nikitopoulos, Konstantina Dritsa, Panos Louridas, and Dimitris Mitropoulos. Crossvul: a cross- language vulnerability dataset with commit data. In Proceedings of the 29th ACM Joint Meeting on Eu- ropean Software Engineering Conference and Sym- posium on the Foundation...

    2021

  77. [84]

    Trust enhancement issues in program repair

    Yannic Noller, Ridwan Shariffdeen, Xiang Gao, and Abhik Roychoudhury. Trust enhancement issues in program repair. InProceedings of the 44th Interna- tional Conference on Software Engineering (ICSE), Pittsburgh, Pennsylvania, page 2228–2240, 2022

    2022

  78. [85]

    Vulgen: Realistic vulnerability genera- tion via pattern mining and deep learning

    Yu Nong, Yuzhe Ou, Michael Pradel, Feng Chen, and Haipeng Cai. Vulgen: Realistic vulnerability genera- tion via pattern mining and deep learning. InProceed- ings of the 2023 IEEE/ACM 45th International Con- ference on Software Engineering (ICSE), Melbourne, Australia, pages 25...

    2023

  79. [86]

    Berger, and Benjamin G

    Gene Novark, Emery D. Berger, and Benjamin G. Zorn. Exterminator: automatically correcting memory errors with high probability. InProceedings of the 28th ACM SIGPLAN Conference on Programming Language De- sign and Implementation (PLDI), San Diego, Califor- nia, USA, page 1–11, 2007

    2007

  80. [87]

    Nvd categories

    NVD. Nvd categories. https://nvd.nist.gov/ vuln/categories, 2025

    2025

  81. [88]

    Report on the static analysis tool exposition (sate) iv

    Vadim Okun, Aurelien Delaitre, Paul E Black, et al. Report on the static analysis tool exposition (sate) iv. NIST Special Publication, 500:297, 2013

    2013

  82. [89]

    Opentext fortify static code ana- lyzer

    OpenText. Opentext fortify static code ana- lyzer. https://www.opentext.com/products/ fortify-static-code-analyzer, 2024

    2024

  83. [90]

    Automating zero-shot patch porting for hard forks

    Shengyi Pan, You Wang, Zhongxin Liu, Xing Hu, Xin Xia, and Shanping Li. Automating zero-shot patch porting for hard forks. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Vienna, Austria, page 363–375, 2024

    2024

  84. [91]

    Benzene: A practical root cause analysis system with an under-constrained state mutation

    Younggi Park, Hwiwon Lee, Jinho Jung, Hyungjoon Koo, and Huy Kang Kim. Benzene: A practical root cause analysis system with an under-constrained state mutation. InProceedings of the 2024 IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA, pages 1865–1883, 2024

    2024

  85. [92]

    Parkinson and Gavin M

    Matthew J. Parkinson and Gavin M. Bierman. Sep- aration logic, abstraction and inheritance. InPro- ceedings of the 35th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), San Francisco, California, USA, pages 75–86, 2008

    2008

  86. [93]

    Examining zero-shot vulnerability repair with large language mod- els

    Hammond Pearce, Benjamin Tan, Baleegh Ahmad, Ramesh Karri, and Brendan Dolan-Gavitt. Examining zero-shot vulnerability repair with large language mod- els. InProceedings of the 2023 IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA, pages 2339–2356, 2023

    2023

  87. [94]

    A comparative study of automatic program repair tech- niques for security vulnerabilities

    Eduard Pinconschi, Rui Abreu, and Pedro Adão. A comparative study of automatic program repair tech- niques for security vulnerabilities. InProceedings of the 32nd International Symposium on Software Re- liability Engineering (ISSRE), Wuhan, China, pages 196–207, 2021

    2021

  88. [95]

    Reynolds

    J.C. Reynolds. Separation logic: A logic for shared mutable data structures. InProceedings of the 17th An- nual IEEE Symposium on Logic in Computer Science (LICS), Copenhagen, Denmark, pages 55–74, 2002

    2002

  89. [96]

    Evmpatch: Timely and automated patch- ing of ethereum smart contracts

    Michael Rodler, Wenting Li, Ghassan O Karame, and Lucas Davi. Evmpatch: Timely and automated patch- ing of ethereum smart contracts. InProceedings of the 30th USENIX Security Symposium (USENIX Security), Virtual Event, pages 1289–1306, 2021. 19

    2021

  90. [97]

    Vulnerability and threat trends report 2024

    SKYBOX Security. Vulnerability and threat trends report 2024. https://www. skyboxsecurity.com/resources/report/ vulne-rability-threat-trends-report-2024/ , 2024

    2024

  91. [98]

    Concolic testing

    Koushik Sen. Concolic testing. InProceedings of the 22nd IEEE/ACM International Conference on Auto- mated Software Engineering (ASE), Atlanta, Georgia, USA, page 571–572, 2007

    2007

  92. [99]

    AddressSanitizer: A fast address sanity checker

    Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. AddressSanitizer: A fast address sanity checker. InProceedings of the 2012 USENIX Annual Technical Conference (USENIX ATC), Boston, MA, USA, pages 309–318, 2012

    2012

  93. [100]

    Leakpair: Proactive repairing of memory leaks in single page web applications

    Arooba Shahoor, Askar Yeltayuly Khamit, Jooyong Yi, and Dongsun Kim. Leakpair: Proactive repairing of memory leaks in single page web applications. In Proceedings of the 38th IEEE/ACM International Con- ference on Automated Software Engineering (ASE), Luxembourg, pages 1175–1187, 2023

    2023

  94. [101]

    Duck, Shin Hwei Tan, Julia Lawall, and Abhik Roychoudhury

    Ridwan Shariffdeen, Xiang Gao, Gregory J. Duck, Shin Hwei Tan, Julia Lawall, and Abhik Roychoudhury. Automated patch backporting in linux (experience pa- per). InProceedings of the 30th ACM SIGSOFT Inter- national Symposium on Software Testing and Analysis (ISSTA), Virtual Eve...

    2021

  95. [102]

    Concolic program repair

    Ridwan Shariffdeen, Yannic Noller, Lars Grunske, and Abhik Roychoudhury. Concolic program repair. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI), Virtual Event, Canada, page 390–405, 2021

    2021

  96. [103]

    Timperley, Yan- nic Noller, Claire Le Goues, and Abhik Roychoudhury

    Ridwan Shariffdeen, Christopher S. Timperley, Yan- nic Noller, Claire Le Goues, and Abhik Roychoudhury. Vulnerability repair via concolic execution and code mutations.ACM Transactions on Software Engineer- ing and Methodology (TOSEM), 34(4):1–27, 2024

    2024

  97. [104]

    Automated patch trans- plantation.ACM Transactions on Software Engineer- ing and Methodology (TOSEM), 30(1):1–36, 2020

    Ridwan Salihin Shariffdeen, Shin Hwei Tan, Mingyuan Gao, and Abhik Roychoudhury. Automated patch trans- plantation.ACM Transactions on Software Engineer- ing and Methodology (TOSEM), 30(1):1–36, 2020

    2020

  98. [105]

    Au- tomatically fixing c buffer overflows using program transformations

    Alex Shaw, Dusten Doggett, and Munawar Hafiz. Au- tomatically fixing c buffer overflows using program transformations. InProceedings of the 2014 44th An- nual IEEE/IFIP International Conference on Depend- able Systems and Networks (DSN), Atlanta, GA, USA, pages 124–135, 2014

    2014

  99. [107]

    Backporting security patches of web ap- plications: A prototype design and implementation on injection vulnerability patches

    Youkun Shi, Yuan Zhang, Tianhan Luo, Xiangyu Mao, Yinzhi Cao, Ziwen Wang, Yudi Zhao, Zongan Huang, and Min Yang. Backporting security patches of web ap- plications: A prototype design and implementation on injection vulnerability patches. InProceedings of the 31st USENIX Secur...

    1993

  100. [108]

    Smartfix: Fixing vul- nerable smart contracts by accelerating generate-and- verify repair using statistical models

    Sunbeom So and Hakjoo Oh. Smartfix: Fixing vul- nerable smart contracts by accelerating generate-and- verify repair using statistical models. InProceedings of the 31st ACM Joint European Software Engineer- ing Conference and Symposium on the Foundations of Software Engineering...

    2023

  101. [109]

    Fix me up: Repairing access-control bugs in web ap- plications

    Sooel Son, Kathryn S McKinley, and Vitaly Shmatikov. Fix me up: Repairing access-control bugs in web ap- plications. InProceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS), San Diego, California, USA, 2013

    2013

  102. [110]

    SoK: Sanitizing for security

    Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn V olckaert, Per Larsen, and Michael Franz. SoK: Sanitizing for security. InProceedings of the 2019 IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA, pages 1275–1295, 2019

    2019

  103. [111]

    Neural machine translation: A review

    Felix Stahlberg. Neural machine translation: A review. Journal of Artificial Intelligence Research, 69:343–418, 2020

    2020

  104. [112]

    Gptscan: Detecting logic vulnerabilities in smart con- tracts by combining gpt with program analysis

    Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Hai- jun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. Gptscan: Detecting logic vulnerabilities in smart con- tracts by combining gpt with program analysis. In Proceedings of the IEEE/ACM 46th International Con- ference on Software Eng...

    2024

  105. [113]

    Automatically diagnos- ing and repairing error handling bugs in c

    Yuchi Tian and Baishakhi Ray. Automatically diagnos- ing and repairing error handling bugs in c. InProceed- ings of the 2017 11th Joint Meeting on Foundations of Software Engineering (ESEC/FSE), Paderborn, Ger- many, page 752–762, 2017

    2017

  106. [114]

    Property- based automated repair of defi protocols

    Palina Tolmach, Yi Li, and Shang-Wei Lin. Property- based automated repair of defi protocols. InProceed- ings of the 37th IEEE/ACM International Conference 20 on Automated Software Engineering (ASE), Rochester, MI, USA, 2022

    2022

  107. [115]

    Osiris: Hunting for integer bugs in ethereum smart contracts

    Christof Ferreira Torres, Julian Schütte, and Radu State. Osiris: Hunting for integer bugs in ethereum smart contracts. InProceedings of the 34th Annual Computer Security Applications Conference (ACSAC), San Juan, PR, USA, page 664–676, 2018

    2018

  108. [116]

    Se- curify: Practical security analysis of smart contracts

    Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Bünzli, and Martin Vechev. Se- curify: Practical security analysis of smart contracts. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS), Toronto, Canada, page ...

    2018

  109. [117]

    From leaks to fixes: Automated repairs for resource leak warnings

    Akshay Utture and Jens Palsberg. From leaks to fixes: Automated repairs for resource leak warnings. InPro- ceedings of the 31st ACM Joint European Software En- gineering Conference and Symposium on the Founda- tions of Software Engineering (ESEC/FSE), San Fran- cisco, USA, pag...

    2023

  110. [118]

    Static au- tomated program repair for heap properties

    Rijnard van Tonder and Claire Le Goues. Static au- tomated program repair for heap properties. InPro- ceedings of the 40th International Conference on Soft- ware Engineering (ICSE), Gothenburg, Sweden, page 151–162, 2018

    2018

  111. [119]

    Gomez, Łukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. InProceedings of the 31st International Conference on Neural Information Processing Systems (NIPS), Long Beach, California, ...

    2017

  112. [120]

    Contracttinker: Llm- empowered vulnerability repair for real-world smart contracts

    Che Wang, Jiashuo Zhang, Jianbo Gao, Libin Xia, Zhi Guan, and Zhong Chen. Contracttinker: Llm- empowered vulnerability repair for real-world smart contracts. InProceedings of the 39th IEEE/ACM Inter- national Conference on Automated Software Engineer- ing (ASE), Sacramento, CA...

    2024

  113. [121]

    Shangwen Wang, Ming Wen, Bo Lin, Hongjun Wu, Yihao Qin, Deqing Zou, Xiaoguang Mao, and Hai Jin. Automated patch correctness assessment: How far are we? InProceedings of the 35th IEEE/ACM Interna- tional Conference on Automated Software Engineering (ASE), Virtual Event, Austral...

    2021

  114. [122]

    Reposvul: A repository-level high-quality vulnerability dataset

    Xinchen Wang, Ruida Hu, Cuiyun Gao, Xin-Cheng Wen, Yujia Chen, and Qing Liao. Reposvul: A repository-level high-quality vulnerability dataset. In Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Pro- ceedings (ICSE-Companion), L...

    2024

  115. [123]

    Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation

    Yue Wang, Weishi Wang, Shafiq Joty, and Steven CH Hoi. Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Process- ing (EMNLP), Virtual Event, ...

    2021

  116. [124]

    Automatically finding patches using genetic programming

    Westley Weimer, ThanhVu Nguyen, Claire Le Goues, and Stephanie Forrest. Automatically finding patches using genetic programming. InProceedings of the 2009 IEEE 31st International Conference on Software Engineering (ICSE), Vancouver, BC, Canada, pages 364–374, 2009

    2009

  117. [125]

    Guidelines for snowballing in system- atic literature studies and a replication in software en- gineering

    Claes Wohlin. Guidelines for snowballing in system- atic literature studies and a replication in software en- gineering. InProceedings of the 18th International Conference on Evaluation and Assessment in Software Engineering (EASE), London, England, United King- dom, pages 1–10, 2014

    2014

  118. [126]

    Formal methods: Practice and experience.ACM Computing Surveys (CSUR), 41(4):1– 36, 2009

    Jim Woodcock, Peter Gorm Larsen, Juan Bicarregui, and John Fitzgerald. Formal methods: Practice and experience.ACM Computing Surveys (CSUR), 41(4):1– 36, 2009

    2009

  119. [127]

    Autogen: Enabling next-gen llm applications via multi-agent conversation framework.arXiv preprint arXiv:2308.08155, 2023

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Shaokun Zhang, Erkang Zhu, Beibin Li, Li Jiang, Xi- aoyun Zhang, and Chi Wang. Autogen: Enabling next-gen llm applications via multi-agent conversation framework.arXiv preprint arXiv:2308.08155, 2023

    2023 arXiv

  120. [128]

    How effective are neural networks for fixing security vulnerabilities

    Yi Wu, Nan Jiang, Hung Viet Pham, Thibaud Lutel- lier, Jordan Davis, Lin Tan, Petr Babkin, and Sameena Shah. How effective are neural networks for fixing security vulnerabilities. InProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (I...

    2023

  121. [129]

    Less train- ing, more repairing please: revisiting automated pro- gram repair via zero-shot learning

    Chunqiu Steven Xia and Lingming Zhang. Less train- ing, more repairing please: revisiting automated pro- gram repair via zero-shot learning. InProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Soft- ware Engineering ...

    2022

  122. [130]

    Automated program repair via conversation: Fixing 162 out of 337 bugs for $0.42 each using chatgpt

    Chunqiu Steven Xia and Lingming Zhang. Automated program repair via conversation: Fixing 162 out of 337 bugs for $0.42 each using chatgpt. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA). Vienna, Austria, page 819–831, 2024. 21

    2024

  123. [131]

    How far can we go with practical function-level pro- gram repair?arXiv preprint arXiv:2404.12833, 2024

    Jiahong Xiang, Xiaoyang Xu, Fanchu Kong, Mingyuan Wu, Zizheng Zhang, Haotian Zhang, and Yuqun Zhang. How far can we go with practical function-level pro- gram repair?arXiv preprint arXiv:2404.12833, 2024

    2024 arXiv

  124. [132]

    What if is not enough? Fixing Null pointer dereference with contextual check

    Yunlong Xing, Shu Wang, Shiyu Sun, Xu He, Kun Sun, and Qi Li. What if is not enough? Fixing Null pointer dereference with contextual check. InProceedings of the 33rd USENIX Security Symposium (USENIX Security), Philadelphia, PA, USA, pages 1367 – 1382, 2024

    2024

  125. [133]

    Racing on the negative force: Efficient vulnerability root-cause analy- sis through reinforcement learning on counterexamples

    Dandan Xu, Di Tang, Yi Chen, XiaoFeng Wang, Kai Chen, Haixu Tang, and Longxing Li. Racing on the negative force: Efficient vulnerability root-cause analy- sis through reinforcement learning on counterexamples. InProceedings of the 33rd USENIX Security Sympo- sium (USENIX Secur...

    2024

  126. [134]

    Vfix: value-flow-guided precise program repair for null pointer dereferences

    Xuezheng Xu, Yulei Sui, Hua Yan, and Jingling Xue. Vfix: value-flow-guided precise program repair for null pointer dereferences. InProceedings of the 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), Montreal, QC, Canada, pages 512–523, 2019

    2019

  127. [135]

    Automatic hot patch generation for android kernels

    Zhengzi Xu, Yulong Zhang, Longri Zheng, Liangzhao Xia, Chenfu Bao, Zhi Wang, and Yang Liu. Automatic hot patch generation for android kernels. InProceed- ings of the 29th USENIX Security Symposium (USENIX Security), Virtual Event, pages 2397–2414, 2020

    2020

  128. [136]

    Chung, Brendan Saltafor- maggio, and Wenke Lee

    Carter Yagemann, Simon P. Chung, Brendan Saltafor- maggio, and Wenke Lee. Automated bug hunting with data-driven symbolic root cause analysis. InProceed- ings of the 2021 ACM SIGSAC Conference on Com- puter and Communications Security (CCS), Virtual Event, Republic of Korea, p...

    2021

  129. [137]

    Arcus: symbolic root cause analysis of exploits in production systems

    Carter Yagemann, Matthew Pruett, Simon P Chung, Kennon Bittick, Brendan Saltaformaggio, and Wenke Lee. Arcus: symbolic root cause analysis of exploits in production systems. InProceedings of the 30th USENIX Security Symposium (USENIX Security), Vir- tual Event, pages 1989–2006, 2021

    1989

  130. [138]

    Modeling and discovering vulnerabilities with code property graphs

    Fabian Yamaguchi, Nico Golde, Daniel Arp, and Kon- rad Rieck. Modeling and discovering vulnerabilities with code property graphs. InProceedings of the 2014 IEEE Symposium on Security and Privacy (S&P), Berkeley, CA, USA, pages 590–604, 2014

    2014

  131. [139]

    Enhancing oss patch back- porting with semantics

    Su Yang, Yang Xiao, Zhengzi Xu, Chengyi Sun, Chen Ji, and Yuqing Zhang. Enhancing oss patch back- porting with semantics. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communi- cations Security (CCS), Copenhagen, Denmark, page 2366–2380, 2023

    2023

  132. [140]

    Thinkrepair: Self-directed automated program repair

    Xin Yin, Chao Ni, Shaohua Wang, Zhenhao Li, Limin Zeng, and Xiaohu Yang. Thinkrepair: Self-directed automated program repair. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Vienna, Austria, page 1274–1286, 2024

    2024

  133. [141]

    Optimal sanitization synthesis for web application vulnerabil- ity repair

    Fang Yu, Ching-Yuan Shueh, Chun-Han Lin, Yu-Fang Chen, Bow-Yaw Wang, and Tevfik Bultan. Optimal sanitization synthesis for web application vulnerabil- ity repair. InProceedings of the 25th International Symposium on Software Testing and Analysis (ISSTA), Saarbrücken, Germany, ...

    2016

  134. [142]

    Tapfixer: Automatic detection and repair of home au- tomation vulnerabilities based on negated-property rea- soning

    Yinbo Yu, Yuanqi Xu, Kepu Huang, and Jiajia Liu. Tapfixer: Automatic detection and repair of home au- tomation vulnerabilities based on negated-property rea- soning. InProceedings of the 33th USENIX Security Symposium (USENIX Security), Philadelphia, PA, USA, pages 4945 – 4962, 2024

    2024

  135. [143]

    Intpatch: Automatically fix integer-overflow- to-buffer-overflow vulnerability at compile-time

    Chao Zhang, Tielei Wang, Tao Wei, Yu Chen, and Wei Zou. Intpatch: Automatically fix integer-overflow- to-buffer-overflow vulnerability at compile-time. In Proceedings of the 15th European Symposium on Research in Computer Security (ESORICS), Athens, Greece, pages 71–86, 2010

    2010

  136. [144]

    Vuladvisor: Natural language suggestion generation for software vulnerability repair

    Jian Zhang, Chong Wang, Anran Li, Wenhan Wang, Tianlin Li, and Yang Liu. Vuladvisor: Natural language suggestion generation for software vulnerability repair. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), Sacramento, CA, U...

    1932

  137. [145]

    Pre-trained model-based automated software vulnerability repair: How far are we?IEEE Transactions on Depend- able and Secure Computing (TDSC), 21(4):2507–2525, 2024

    Quanjun Zhang, Chunrong Fang, Bowen Yu, Weisong Sun, Tongke Zhang, and Zhenyu Chen. Pre-trained model-based automated software vulnerability repair: How far are we?IEEE Transactions on Depend- able and Secure Computing (TDSC), 21(4):2507–2525, 2024

    2024

  138. [146]

    Example-based vulnerability detection and repair in Java code

    Ying Zhang, Ya Xiao, Md Mahir Asef Kabir, Dan- feng (Daphne) Yao, and Na Meng. Example-based vulnerability detection and repair in Java code. In Proceedings of the 30th IEEE/ACM International Con- ference on Program Comprehension (ICPC), Virtual Event, page 190–201, 2022

    2022

  139. [147]

    The inflection point hypothe- sis: a principled debugging approach for locating the root cause of a failure

    Yongle Zhang, Kirk Rodrigues, Yu Luo, Michael Stumm, and Ding Yuan. The inflection point hypothe- sis: a principled debugging approach for locating the root cause of a failure. InProceedings of the 27th ACM 22 Symposium on Operating Systems Principles (SOSP), Huntsville, Ontar...

    2019

  140. [148]

    Duck, and Ab- hik Roychoudhury

    Yuntong Zhang, Xiang Gao, Gregory J. Duck, and Ab- hik Roychoudhury. Program vulnerability repair via inductive inference. InProceedings of the 31st ACM SIGSOFT International Symposium on Software Test- ing and Analysis (ISSTA), Virtual Event, South Korea, page 691–702, 2022

    2022

  141. [149]

    Smartshield: Automatic smart contract protection made easy

    Yuyao Zhang, Siqi Ma, Juanru Li, Kailai Li, Surya Nepal, and Dawu Gu. Smartshield: Automatic smart contract protection made easy. InProceedings of the 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), Lon- don, Ontario, Canada, ...

    2020

  142. [150]

    Xin Zhou, Sicong Cao, Xiaobing Sun, and David Lo. Large language model for vulnerability detection and repair: Literature review and the road ahead.ACM Transactions on Software Engineering and Methodol- ogy (TOSEM), 34(5):1–31, 2024

    2024

  143. [151]

    Out of sight, out of mind: Better automatic vulnerability repair by broadening input ranges and sources

    Xin Zhou, Kisub Kim, Bowen Xu, Donggyun Han, and David Lo. Out of sight, out of mind: Better automatic vulnerability repair by broadening input ranges and sources. InProceedings of the IEEE/ACM 46th Inter- national Conference on Software Engineering (ICSE), Lisbon, Portugal, p...

    2024

  144. [152]

    ✔” denotes that a test case runs successfully and “✘

    Zhou Zhou, Lili Bo, Xiaoxue Wu, Xiaobing Sun, Tao Zhang, Bin Li, Jiale Zhang, and Sicong Cao. Spvf: Security property assisted vulnerability fixing via attention-based models.Empirical Software Engineer- ing (ESE), 27(7):171, 2022. Appendix A Vulnerability Location vs. Fix Loc...

    2022

  145. [153]

    • Limited scenarios

    only provides documentation on building, but not running; SA VER [44] requires detailed information about memory objects, which are not available to us; CrashRe- pair [103]does not provide instructions on how to write the configuration file when testing new vulnerabilities; th...

    2017

  146. [154]

    corrupt name field: namesz of %lu is too large for a numeric value\n

    for CVE-2017-9043. It is semantically equivalent to the human-crafted ground-truth patch presented in Listing 8 because it contains the if-statement if(!(bytes<=8)) such that an error will occur when the condition is met. 25 @@ -16948,10 +16948,18 @@ print_gnu_build_attribute_...

    2017

  147. [155]

    We make two observations

    and NTR [48]. We make two observations. First, NTR achieves a patch compilation rate and a test pass rate of 71.5% and 8.2%, respectively, which are respectively 43.4% and 4% higher than those of CquenceR (28.1% and 4.2%). This discrepancy can be attributed to the following: C...

    2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.