Neural Transfer Learning for Repairing Security Vulnerabilities in C Code

In this paper, we address the problem of automatic repair of software vulnerabilities with deep learning. The major problemwith data-driven vulnerability repair is that the few existing datasets of known confirmed vulnerabilities consist of only a few thousandexamples. However, training a deep learning model often requires hundreds of thousands of examples. In this work, we leverage theintuition that the bug fixing task and the vulnerability fixing task are related, and that the knowledge learned from bug fixes can betransferred to fixing vulnerabilities. In the machine learning community, this technique is called transfer learning. In this paper, wepropose an approach for repairing security vulnerabilities named VRepair which is based on transfer learning. VRepair is first trainedon a large bug fix corpus and is then tuned on a vulnerability fix dataset, which is an order of magnitude smaller. In our experiments,we show that a model trained only on a bug fix corpus can already fix some vulnerabilities. Then, we demonstrate that transfer learningimproves the ability to repair vulnerable C functions. We also show that the transfer learning model performs better than a modeltrained with a denoising task and fine-tuned on the vulnerability fixing task. To sum up, this paper shows that transfer learning workswell for repairing security vulnerabilities in C compared to learning on a small dataset.