{"id":"https://openalex.org/W3195612455","doi":"https://doi.org/10.1109/ase51524.2021.9678622","title":"DeepCVA: Automated Commit-level Vulnerability Assessment with Deep Multi-task Learning","display_name":"DeepCVA: Automated Commit-level Vulnerability Assessment with Deep Multi-task Learning","publication_year":2021,"publication_date":"2021-11-01","ids":{"openalex":"https://openalex.org/W3195612455","doi":"https://doi.org/10.1109/ase51524.2021.9678622","mag":"3195612455"},"language":"en","primary_location":{"id":"doi:10.1109/ase51524.2021.9678622","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ase51524.2021.9678622","pdf_url":null,"source":{"id":"https://openalex.org/S4363608212","display_name":"2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017801401","display_name":"Triet Huynh Minh Le","orcid":"https://orcid.org/0000-0003-1935-037X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Triet Huynh Minh Le","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005919758","display_name":"David Hin","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"David Hin","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040400519","display_name":"Roland Croft","orcid":"https://orcid.org/0000-0001-5011-6587"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Roland Croft","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058693284","display_name":"Muhammad Ali Babar","orcid":"https://orcid.org/0000-0001-6653-6076"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"M. Ali Babar","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I5681781"],"apc_list":null,"apc_paid":null,"fwci":11.7609,"has_fulltext":false,"cited_by_count":63,"citation_normalized_percentile":{"value":0.99062994,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"717","last_page":"729"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9846000075340271,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/commit","display_name":"Commit","score":0.8535568118095398},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7872956395149231},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7667733430862427},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.6813657879829407},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.5946447849273682},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5684658885002136},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.5550007224082947},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5408353209495544},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5160800814628601},{"id":"https://openalex.org/keywords/scale","display_name":"Scale (ratio)","score":0.4433758854866028},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3405783772468567},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3399074673652649},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.11321589350700378},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10362958908081055},{"id":"https://openalex.org/keywords/systems-engineering","display_name":"Systems engineering","score":0.07782211899757385}],"concepts":[{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.8535568118095398},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7872956395149231},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7667733430862427},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.6813657879829407},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.5946447849273682},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5684658885002136},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5550007224082947},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5408353209495544},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5160800814628601},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.4433758854866028},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3405783772468567},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3399074673652649},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.11321589350700378},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10362958908081055},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.07782211899757385},{"id":"https://openalex.org/C111368507","wikidata":"https://www.wikidata.org/wiki/Q43518","display_name":"Oceanography","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ase51524.2021.9678622","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ase51524.2021.9678622","pdf_url":null,"source":{"id":"https://openalex.org/S4363608212","display_name":"2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":108,"referenced_works":["https://openalex.org/W918972627","https://openalex.org/W1498436455","https://openalex.org/W1522301498","https://openalex.org/W1655956671","https://openalex.org/W1665214252","https://openalex.org/W1832693441","https://openalex.org/W1836465849","https://openalex.org/W1857789879","https://openalex.org/W1966976587","https://openalex.org/W1971733255","https://openalex.org/W1980850370","https://openalex.org/W1986222079","https://openalex.org/W2003315002","https://openalex.org/W2004228899","https://openalex.org/W2035030692","https://openalex.org/W2042600809","https://openalex.org/W2059185913","https://openalex.org/W2061533417","https://openalex.org/W2069268700","https://openalex.org/W2085701101","https://openalex.org/W2095705004","https://openalex.org/W2101726875","https://openalex.org/W2102193394","https://openalex.org/W2133564696","https://openalex.org/W2147386665","https://openalex.org/W2148143831","https://openalex.org/W2150593711","https://openalex.org/W2157353183","https://openalex.org/W2295598076","https://openalex.org/W2493916176","https://openalex.org/W2523246573","https://openalex.org/W2599482629","https://openalex.org/W2603292144","https://openalex.org/W2606150376","https://openalex.org/W2740329368","https://openalex.org/W2742079690","https://openalex.org/W2767521898","https://openalex.org/W2768348081","https://openalex.org/W2771090858","https://openalex.org/W2781021471","https://openalex.org/W2783078595","https://openalex.org/W2794258351","https://openalex.org/W2794601162","https://openalex.org/W2796200341","https://openalex.org/W2806718802","https://openalex.org/W2884276923","https://openalex.org/W2890264517","https://openalex.org/W2892195839","https://openalex.org/W2894722365","https://openalex.org/W2896457183","https://openalex.org/W2902240649","https://openalex.org/W2903359694","https://openalex.org/W2906845177","https://openalex.org/W2912425542","https://openalex.org/W2918408501","https://openalex.org/W2950133940","https://openalex.org/W2953482317","https://openalex.org/W2955991060","https://openalex.org/W2962698568","https://openalex.org/W2963321189","https://openalex.org/W2963341956","https://openalex.org/W2963447020","https://openalex.org/W2963501364","https://openalex.org/W2963548617","https://openalex.org/W2963926786","https://openalex.org/W2964150020","https://openalex.org/W2964279097","https://openalex.org/W2964301648","https://openalex.org/W2964308564","https://openalex.org/W2967556797","https://openalex.org/W2969223458","https://openalex.org/W2982413960","https://openalex.org/W2987083812","https://openalex.org/W3001965384","https://openalex.org/W3009517030","https://openalex.org/W3011013751","https://openalex.org/W3033393716","https://openalex.org/W3040158574","https://openalex.org/W3047727558","https://openalex.org/W3080878745","https://openalex.org/W3081792418","https://openalex.org/W3083954092","https://openalex.org/W3089621332","https://openalex.org/W3090988470","https://openalex.org/W3102476541","https://openalex.org/W3102673518","https://openalex.org/W3105867435","https://openalex.org/W3122473522","https://openalex.org/W3126095862","https://openalex.org/W3156556445","https://openalex.org/W3172106546","https://openalex.org/W3176465319","https://openalex.org/W3184339106","https://openalex.org/W4238011405","https://openalex.org/W4252684946","https://openalex.org/W4256657178","https://openalex.org/W4285719527","https://openalex.org/W4289293306","https://openalex.org/W4294170691","https://openalex.org/W4294214983","https://openalex.org/W6637242042","https://openalex.org/W6638667902","https://openalex.org/W6671861500","https://openalex.org/W6674330103","https://openalex.org/W6745609711","https://openalex.org/W6758995895","https://openalex.org/W6770406395","https://openalex.org/W7001112124"],"related_works":["https://openalex.org/W1883246888","https://openalex.org/W2370114625","https://openalex.org/W2947584067","https://openalex.org/W2062873522","https://openalex.org/W3118510577","https://openalex.org/W3157230915","https://openalex.org/W1756374135","https://openalex.org/W2789975780","https://openalex.org/W2007895524","https://openalex.org/W2393340519"],"abstract_inverted_index":{"It":[0],"is":[1,22,50,117],"increasingly":[2],"suggested":[3],"to":[4,12,27,36,52,71,104,123,152,169],"identify":[5],"Software":[6],"Vulnerabilities":[7],"(SVs)":[8],"in":[9,99,174],"code":[10],"commits":[11,30,94],"give":[13],"early":[14,173],"warnings":[15],"about":[16,40],"potential":[17],"security":[18],"risks.":[19],"However,":[20],"there":[21],"a":[23,64],"lack":[24],"of":[25,46,110],"effort":[26],"assess":[28,171],"vulnerability-contributing":[29,93],"right":[31],"after":[32],"they":[33],"are":[34],"detected":[35],"provide":[37],"timely":[38],"information":[39,49],"the":[41,56,59,106,118,163],"exploitability,":[42],"impact":[43],"and":[44,54,108,132,143,166],"severity":[45],"SVs.":[47,61],"Such":[48],"important":[51],"plan":[53],"prioritize":[55],"mitigation":[57],"for":[58],"identified":[60],"We":[62,87,113],"propose":[63],"novel":[65],"Deep":[66],"multi-task":[67],"learning":[68],"model,":[69],"DeepCVA,":[70],"automate":[72],"seven":[73,147],"Commit-level":[74],"Vulnerability":[75,82],"Assessment":[76],"tasks":[77],"simultaneously":[78],"based":[79],"on":[80,91],"Common":[81],"Scoring":[83],"System":[84],"(CVSS)":[85],"metrics.":[86],"conduct":[88],"large-scale":[89],"experiments":[90],"1,229":[92],"containing":[95],"542":[96],"different":[97],"SVs":[98,172],"246":[100],"real-world":[101],"software":[102,175],"projects":[103],"evaluate":[105],"effectiveness":[107],"efficiency":[109],"our":[111],"model.":[112],"show":[114],"that":[115],"DeepCVA":[116,136,161],"best-performing":[119],"model":[120,155],"with":[121],"38%":[122],"59.8%":[124],"higher":[125],"Matthews":[126],"Correlation":[127],"Coefficient":[128],"than":[129,146],"many":[130],"supervised":[131],"unsupervised":[133],"baseline":[134],"models.":[135],"also":[137],"requires":[138],"6.3":[139],"times":[140],"less":[141,154],"training":[142],"validation":[144],"time":[145],"cumulative":[148],"assessment":[149],"models,":[150],"leading":[151],"significantly":[153],"maintenance":[156],"cost":[157],"as":[158],"well.":[159],"Over-all,":[160],"presents":[162],"first":[164],"effective":[165],"efficient":[167],"solution":[168],"automatically":[170],"systems.":[176]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":15},{"year":2024,"cited_by_count":24},{"year":2023,"cited_by_count":14},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}