Automated software vulnerability detection by leveraging open source knowledge

风河系统是为智能边缘提供软件的全球领先者。尽管Wind River和其他软件工程从业者已经在检测和消除他们软件中的漏洞方面付出了努力，但软件项目日益增长的复杂性和规模使这些任务变得具有挑战性。另一方面，开源社区经常在网上分享有关已发现漏洞的知识。因此，在这项提议中，我们计划利用开源社区的知识来协助软件漏洞检测。特别是，我们设计的方法可以从公开论坛中发现对软件漏洞的讨论，并在讨论中识别相关的源代码。对于已识别的源代码，我们计划应用代码克隆检测和代码搜索方法来检测其他软件项目中是否存在类似的漏洞，例如来自Wind River System的源代码。拟议的研究将产生可定期共享的关于已知漏洞的报告和自动检测此类漏洞的方法。这些报告和方法可以为加拿大和世界各地的风河系统从业者和其他软件工程从业者提供参考。

Wind River System is a global leader in delivering software for the intelligent edge. Although Wind River and other software engineering practitioners have spent efforts on detecting and removing the vulnerabilities from their software, the ever increasing complexity and scale of software projects makes the tasks challenging. On the other hand, the open source community often shares knowledge about the discovered vulnerabilities online. Therefore, in this proposal, we plan to leveraging knowledge from the open source community in order to assist in software vulnerability detection. in particular, we design approaches that discover the discussion of software vulnerabilities from open forums and identify the associated source code in the discussion. With the identified source code, we plan to apply code clone detection and code search approaches to detect the existence of similar vulnerabilities inside other software projects, e.g., the source code from Wind River System. The proposed research will result in reports that can be shared regularly about the known vulnerabilities and approaches that automatically detect such vulnerabilities. The reports and the approaches can benefit the practitioners in Wind River System and other software engineering practitioners in Canada and the world.