Automated software vulnerability detection by leveraging open source knowledge

风河系统是为智能边缘提供软件的全球领导者。尽管风河和其他软件工程从业者已经花了很多精力来检测和消除软件中的漏洞，但软件项目的复杂性和规模的不断增加使得任务变得具有挑战性。另一方面，开源社区经常在线分享有关发现的漏洞的知识。因此，在本提案中，我们计划利用开源社区的知识来协助软件漏洞检测。特别地，我们设计了从开放论坛中发现软件漏洞讨论并在讨论中识别相关源代码的方法。有了确定的源代码，我们计划应用代码克隆检测和代码搜索的方法来检测其他软件项目中是否存在类似的漏洞，例如风河系统的源代码。拟议的研究将产生报告，可以定期共享有关已知漏洞和自动检测此类漏洞的方法的报告。这些报告和方法可以使风河系统的从业者以及加拿大和世界其他软件工程从业者受益。

Wind River System is a global leader in delivering software for the intelligent edge. Although Wind River and other software engineering practitioners have spent efforts on detecting and removing the vulnerabilities from their software, the ever increasing complexity and scale of software projects makes the tasks challenging. On the other hand, the open source community often shares knowledge about the discovered vulnerabilities online. Therefore, in this proposal, we plan to leveraging knowledge from the open source community in order to assist in software vulnerability detection. in particular, we design approaches that discover the discussion of software vulnerabilities from open forums and identify the associated source code in the discussion. With the identified source code, we plan to apply code clone detection and code search approaches to detect the existence of similar vulnerabilities inside other software projects, e.g., the source code from Wind River System. The proposed research will result in reports that can be shared regularly about the known vulnerabilities and approaches that automatically detect such vulnerabilities. The reports and the approaches can benefit the practitioners in Wind River System and other software engineering practitioners in Canada and the world.