陆工大赛题三——漏洞影响版本识别 #5
14
README_V2.md
14
README_V2.md
|
|
@ -4,7 +4,7 @@
|
|||
### dataResource部分
|
||||
dataResource文件夹中包含data和JarResource。
|
||||
|
||||
data文件夹存放代码运行所需的数据文件（在运行前需要将data文件复制到相应的地址，在环境配置中[数据准备](#数据准备)详细解释）。
|
||||
data文件夹存放代码运行所需的数据文件。
|
||||
> c_cve_fix_detail.json与java_cve_fix_detail.json提供代码运行所需的被测项目的存储库地址(repo_url)。
|
||||
>
|
||||
> dataset.json提供代码运行所需的项目名称project、漏洞标识符cve_id以及对应的漏洞修复位置fix_commits，并且该文件还是方法的ground-truth。
|
||||
|
|
@ -54,18 +54,14 @@ src是方法主体部分，包含git_analysis、szz以及8个py文件。git_anal
|
|||
| python_Levenshtein | 0.25.1 |
|
||||
| unidiff | 0.6.0 |
|
||||
|
||||
### 数据准备
|
||||
方法一：构建绝对路径为“/data1/baolingfeng”的文件夹,并将dataResource中的data和JarResource两个文件夹分别移动（或复制）到“/data1/baolingfeng”路径下。
|
||||
|
||||
方法二：将dataReource文件夹的绝对路径与“/data1/baolingfeng”建立软链接
|
||||
|
||||
## :computer: 代码运行
|
||||
第一步：执行src/main.py中run_all_project()函数，这将为dataset.json中所有项目分别应用五种算法，其结果（漏洞引入位置）保存在“/data1/baolingfeng/SZZ/results”文件夹中。
|
||||
其中time.txt记录了各个方法的运行耗时。
|
||||
第一步：执行src/main.py。其中run_all_project()函数，这将为dataset.json中所有项目分别应用五种算法，其结果（漏洞引入位置）保存在“/data1/baolingfeng/results”文件夹中。
|
||||
其中time.txt记录了各个方法的运行耗时。step_oneAndtwo()和step_three()函数，生成漏洞影响范围，其结果保存在“/data1/baolingfeng/results”的vulnerable_versions_{method}.json中。
|
||||
|
||||
第二步：执行src/main.py中step_oneAndtwo()和step_three()函数，生成漏洞影响范围。
|
||||
第二步：执行src/resultStat.py文件，将评估五个方法识别漏洞引入位置的结果，结果文件放在“/data1/baolingfeng/results/initCommit_stat.csv”中。
|
||||
|
||||
第三步：执行src/resultStat.py文件，将评估五个方法的结果，结果文件放在“/data1/baolingfeng/SZZ/results/xx.txt”中。
|
||||
第三步：执行src/version_stat.py文件，将评估vszz和VICLocator确认漏洞影响范围的结果，结果文件存放在“/data1/baolingfeng/results/version_stat.csv”中。
|
||||
|
||||
注意：首次运行代码，会下载dataset.json中涉及的项目到相应文件夹，此步骤需连接网络且较耗费时间（这部分耗时在RQ2中并未计算）。
|
||||
|
||||
|
|
|
|||
|
|
@ -299,7 +299,7 @@ def step_three(methods,project_cve_commits):
|
|||
tag_result['fixing_details'].append(commit_infos)
|
||||
tag_results.append(tag_result)
|
||||
# 版本标签结果
|
||||
with open(os.path.join(RESULT_DIR,f'vulnerable_versions_{method}_1.json'),'w') as f:
|
||||
with open(os.path.join(RESULT_DIR,f'vulnerable_versions_{method}.json'),'w') as f:
|
||||
json.dump(tag_results,f,indent=4)
|
||||
f.close()
|
||||
# 没识别到的统计结果
|
||||
|
|
@ -313,8 +313,8 @@ if __name__ == "__main__":
|
|||
project_cve_commits = load_annotated_commits()
|
||||
methods = ['vszz','b','ag','ma','vic']
|
||||
|
||||
# run_all_project(methods,project_cve_commits)
|
||||
run_all_project(methods,project_cve_commits)
|
||||
|
||||
# step_oneAndtwo(project_cve_commits)
|
||||
step_oneAndtwo(project_cve_commits)
|
||||
methods_news = ['GT','vszz','vic']
|
||||
step_three(methods_news, project_cve_commits)
|
||||
|
|
@ -15,9 +15,8 @@ class ResultStat:
|
|||
if not os.path.exists(self.log_dir):
|
||||
os.makedirs(self.log_dir)
|
||||
|
||||
self.aaaaa = {}
|
||||
self.bbbbb = {}
|
||||
|
||||
res = {'correct':0,'identify':0,'gt':0,'precision':0,'recall':0,'f1':0}
|
||||
self.results = {"b": {}, "ag": {}, "ma": {}, "vszz": {}, "vic": {}}
|
||||
# 定义一个函数，用于创建新的日志记录器并设置不同的文件
|
||||
def create_logger(self,log_file_name):
|
||||
logger = logging.getLogger(log_file_name)
|
||||
|
|
@ -106,17 +105,16 @@ class ResultStat:
|
|||
if ground_truth_init_commit == init_commits:
|
||||
init_correct_num += 1
|
||||
com = f"{project}, {cve_id}, {fix_commit}, {file}, {line}"
|
||||
self.aaaaa[com] = "true"
|
||||
else:
|
||||
logger.info(f'init_commits:{init_commits}\n ground_truth_init_commit:'
|
||||
f'{ground_truth_init_commit}\nnot equal!')
|
||||
com = f"{project}, {cve_id}, {fix_commit}, {file}, {line}"
|
||||
self.aaaaa[com] = "false"
|
||||
|
||||
|
||||
fin.close()
|
||||
# logger.info(f"path_correct_num:{path_correct_num},init_correct_num:{init_correct_num},method_num:{method_num}")
|
||||
logger.info(f"init_correct_num:{init_correct_num},method_num:{method_num}")
|
||||
self.results[key]['identify'] = method_num
|
||||
|
||||
def recall_metric(self,key):
|
||||
# 设置日志文件路径
|
||||
|
|
@ -156,16 +154,16 @@ class ResultStat:
|
|||
if ground_truth_init_commit == init_commits:
|
||||
init_correct_num += 1
|
||||
com = f"{project}, {cve_id}, {fix_commit}, {file}, {line}"
|
||||
self.bbbbb[com] = "true"
|
||||
else:
|
||||
logger.info(f'init_commits:{init_commits}\n ground_truth_init_commit:'
|
||||
f'{ground_truth_init_commit}\nnot equal!')
|
||||
com = f"{project}, {cve_id}, {fix_commit}, {file}, {line}"
|
||||
self.bbbbb[com] = "false"
|
||||
|
||||
fin.close()
|
||||
# logger.info(f"path_correct_num:{path_correct_num},init_correct_num:{init_correct_num},method_num:{method_num}")
|
||||
logger.info(f"init_correct_num:{init_correct_num},method_num:{method_num}")
|
||||
self.results[key]['correct'] = init_correct_num
|
||||
self.results[key]['gt'] = method_num
|
||||
|
||||
def query_vszz_and_iast(self,key,project,cve_id,fix_commit,file,line):
|
||||
init_fix_path = []
|
||||
|
|
@ -218,14 +216,20 @@ class ResultStat:
|
|||
f.close()
|
||||
|
||||
if __name__ == '__main__':
|
||||
fout = open(os.path.join(RESULT_DIR, f'initCommit_stat.csv'),'w')
|
||||
obj = ResultStat()
|
||||
''' ['b','ag','ma','vszz','vic'] '''
|
||||
methods = ['b','ag','ma','vszz','vic']
|
||||
for method in methods:
|
||||
obj.precision_metric_one(method)
|
||||
obj.recall_metric(method)
|
||||
|
||||
|
||||
fout.write("corect,identify,GT_num,Precision,Recall,F1\n")
|
||||
for res in obj.results:
|
||||
precision = obj.results[res]['correct']/obj.results[res]['identify']
|
||||
recall = obj.results[res]['correct']/obj.results[res]['gt']
|
||||
f1 = (2*precision*recall)/(precision+recall)
|
||||
fout.write(f'{obj.results[res]["correct"]},{obj.results[res]["identify"]},'
|
||||
f'{obj.results[res]["gt"]},{precision},{recall},{f1}\n')
|
||||
project_cve_commits = load_annotated_commits()
|
||||
methods.append("GT")
|
||||
obj.unrecognizedStat(methods,project_cve_commits)
|
||||
|
|
|
|||
|
|
@ -43,7 +43,9 @@ def query_versions_json(path):
|
|||
return cve_versions
|
||||
|
||||
if __name__ == '__main__':
|
||||
fout = open(os.path.join(RESULT_DIR,'version_stat.csv'), 'w')
|
||||
|
||||
results = {'vszz':{},"vic":{}}
|
||||
methods_new = ['vszz','vic']
|
||||
gt_path = os.path.join(RESULT_DIR,'vulnerable_versions_GT.json')
|
||||
gt_versions = query_versions_json(gt_path)
|
||||
|
|
@ -54,32 +56,29 @@ if __name__ == '__main__':
|
|||
method_path = os.path.join(RESULT_DIR,f'vulnerable_versions_{method}.json')
|
||||
method_versions = query_versions_json(method_path)
|
||||
|
||||
res = {"0": 0, "1": 0, "2": 0, "3": 0, "4": 0,"5":0}
|
||||
error = { "1": [], "2": [], "3": [], "4": [],"5":[]}
|
||||
|
||||
res = {"0": 0, "1": 0, "2": 0, "3": 0, "4": 0,"5":0,"identify":0}
|
||||
for cve in method_versions:
|
||||
num += 1
|
||||
data = {}
|
||||
# print(cve)
|
||||
# print(method_versions[cve])
|
||||
try:
|
||||
gt = gt_versions[cve]
|
||||
# print(gt)
|
||||
status = compare_product_arrays_set(method_versions[cve], gt)
|
||||
res[status] += 1
|
||||
# print(status)
|
||||
if status == "0":
|
||||
continue
|
||||
# elif status == "1":
|
||||
# print(method_versions[cve],"\n", gt)
|
||||
error[status].append(cve)
|
||||
except KeyError as e:
|
||||
print(e)
|
||||
res['5'] += 1
|
||||
error["5"].append(cve)
|
||||
print(res)
|
||||
print(error)
|
||||
print(num)
|
||||
|
||||
res['identify'] = num
|
||||
results[method] = res
|
||||
fout.write("method,state1,state2,state3,state4,state5,correct,identify,precision,recall,F1\n")
|
||||
for res in results:
|
||||
precision = results[res]['0']/results[res]['identify']
|
||||
recall = results[res]['0']/171
|
||||
f1 = (2*precision*recall)/(precision+recall)
|
||||
fout.write(f"{res},{results[res]['1']},{results[res]['2']},{results[res]['3']},"
|
||||
f"{results[res]['4']},{results[res]['5']},{results[res]['0']},"
|
||||
f"{results[res]['identify']},{precision},{recall},{f1}\n")
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue