{"id":"https://openalex.org/W4394769344","doi":"https://doi.org/10.1145/3597503.3639202","title":"Where is it? Tracing the Vulnerability-relevant Files from Vulnerability Reports","display_name":"Where is it? Tracing the Vulnerability-relevant Files from Vulnerability Reports","publication_year":2024,"publication_date":"2024-04-12","ids":{"openalex":"https://openalex.org/W4394769344","doi":"https://doi.org/10.1145/3597503.3639202"},"language":"en","primary_location":{"id":"doi:10.1145/3597503.3639202","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639202","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639202","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639202","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010290885","display_name":"Jiamou Sun","orcid":"https://orcid.org/0000-0002-5212-7068"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Jiamou Sun","raw_affiliation_strings":["CSIRO's Data61, Eveleigh, New South Wales, Australia"],"raw_orcid":"https://orcid.org/0000-0002-5212-7068","affiliations":[{"raw_affiliation_string":"CSIRO's Data61, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032440450","display_name":"Jieshan Chen","orcid":"https://orcid.org/0000-0002-2700-7478"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Jieshan Chen","raw_affiliation_strings":["CSIRO's Data61, Eveleigh, New South Wales, Australia"],"raw_orcid":"https://orcid.org/0000-0002-2700-7478","affiliations":[{"raw_affiliation_string":"CSIRO's Data61, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028641941","display_name":"Zhenchang Xing","orcid":"https://orcid.org/0000-0001-7663-1421"},"institutions":[{"id":"https://openalex.org/I118347636","display_name":"Australian National University","ror":"https://ror.org/019wvm592","country_code":"AU","type":"education","lineage":["https://openalex.org/I118347636"]},{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Zhenchang Xing","raw_affiliation_strings":["Australian National University, Canberra, Australia","CSIRO's Data61, Eveleigh, New South Wales, Australia","CSIRO's Data61, Eveleigh, New South Wales, Australia Australian National University, Canberra, Australia"],"raw_orcid":"https://orcid.org/0000-0001-7663-1421","affiliations":[{"raw_affiliation_string":"Australian National University, Canberra, Australia","institution_ids":["https://openalex.org/I118347636"]},{"raw_affiliation_string":"CSIRO's Data61, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]},{"raw_affiliation_string":"CSIRO's Data61, Eveleigh, New South Wales, Australia Australian National University, Canberra, Australia","institution_ids":["https://openalex.org/I118347636","https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100652461","display_name":"Qinghua Lu","orcid":"https://orcid.org/0000-0002-9466-1672"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Qinghua Lu","raw_affiliation_strings":["Data61, CSIRO, Eveleigh, New South Wales, Australia"],"raw_orcid":"https://orcid.org/0000-0002-9466-1672","affiliations":[{"raw_affiliation_string":"Data61, CSIRO, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006841485","display_name":"Xiwei Xu","orcid":"https://orcid.org/0000-0002-2273-1862"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Xiwei Xu","raw_affiliation_strings":["Data61, CSIRO, Eveleigh, New South Wales, Australia"],"raw_orcid":"https://orcid.org/0000-0002-2273-1862","affiliations":[{"raw_affiliation_string":"Data61, CSIRO, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5064683660","display_name":"Liming Zhu","orcid":"https://orcid.org/0000-0001-5839-3765"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Liming Zhu","raw_affiliation_strings":["CSIRO's Data61 & School of CSE, UNSW, Eveleigh, New South Wales, Australia"],"raw_orcid":"https://orcid.org/0000-0001-5839-3765","affiliations":[{"raw_affiliation_string":"CSIRO's Data61 & School of CSE, UNSW, Eveleigh, New South Wales, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8014577627182007},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.7695305943489075},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7168099880218506},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.5585487484931946},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.5571150183677673},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5235751867294312},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4759870767593384},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.46268144249916077},{"id":"https://openalex.org/keywords/file-system","display_name":"File system","score":0.41656672954559326},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.41444146633148193},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.36927732825279236},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.362465500831604},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.36138811707496643},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.32916343212127686},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.30673694610595703},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11053285002708435}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8014577627182007},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.7695305943489075},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7168099880218506},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5585487484931946},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.5571150183677673},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5235751867294312},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4759870767593384},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46268144249916077},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.41656672954559326},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.41444146633148193},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.36927732825279236},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.362465500831604},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.36138811707496643},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32916343212127686},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.30673694610595703},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11053285002708435},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3597503.3639202","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639202","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639202","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3597503.3639202","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3597503.3639202","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3597503.3639202","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the IEEE/ACM 46th International Conference on Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4394769344.pdf","grobid_xml":"https://content.openalex.org/works/W4394769344.grobid-xml"},"referenced_works_count":34,"referenced_works":["https://openalex.org/W1530040998","https://openalex.org/W1539495021","https://openalex.org/W1566289585","https://openalex.org/W2148143831","https://openalex.org/W2155524176","https://openalex.org/W2157825442","https://openalex.org/W2165612380","https://openalex.org/W2325227998","https://openalex.org/W2634106992","https://openalex.org/W2740329368","https://openalex.org/W2742244373","https://openalex.org/W2766898821","https://openalex.org/W2885030880","https://openalex.org/W2892181857","https://openalex.org/W2901560623","https://openalex.org/W2947362543","https://openalex.org/W2962698568","https://openalex.org/W2976184969","https://openalex.org/W2998879504","https://openalex.org/W3009129408","https://openalex.org/W3090843874","https://openalex.org/W3167276542","https://openalex.org/W3195612455","https://openalex.org/W3199467273","https://openalex.org/W3202579690","https://openalex.org/W4299301436","https://openalex.org/W4308643023","https://openalex.org/W4308643066","https://openalex.org/W4312436517","https://openalex.org/W4312870949","https://openalex.org/W4313195722","https://openalex.org/W4384345662","https://openalex.org/W4384345689","https://openalex.org/W4384345766"],"related_works":["https://openalex.org/W2393340519","https://openalex.org/W2390459954","https://openalex.org/W3043810321","https://openalex.org/W4220885008","https://openalex.org/W2057803998","https://openalex.org/W4298219515","https://openalex.org/W1613146948","https://openalex.org/W3118510577","https://openalex.org/W2021298062","https://openalex.org/W2185499427"],"abstract_inverted_index":{"With":[0],"the":[1,76,86,101,126,133,143,146,172,180,189],"widely":[2],"usage":[3],"of":[4,32,107,135,145,174,191,197],"open-source":[5],"software,":[6],"supply-chain-based":[7],"vulnerability":[8,25,48,63],"attacks,":[9],"including":[10],"SolarWind":[11],"and":[12,61,103,119,154,157],"Log4Shell,":[13],"have":[14,55,66],"posed":[15],"significant":[16],"risks":[17],"to":[18,35,124],"software":[19,30,195],"security.":[20],"Currently,":[21],"people":[22],"rely":[23],"on":[24,184],"advisory":[26],"databases":[27],"or":[28],"commercial":[29],"bill":[31,196],"materials":[33],"(SBOM)":[34],"defend":[36],"against":[37],"potential":[38],"risks.":[39],"Unfortunately,":[40],"these":[41],"datasets":[42],"do":[43],"not":[44,56],"provide":[45],"finer-grained":[46,193],"file-level":[47],"information,":[49],"compromising":[50],"their":[51,67],"effectiveness.":[52],"Previous":[53],"works":[54],"adequately":[57],"addressed":[58],"this":[59,72],"issue,":[60],"mainstream":[62],"detection":[64,169],"methods":[65],"drawbacks":[68],"that":[69,83,142],"hinder":[70],"resolving":[71],"gap.":[73],"Driven":[74],"by":[75],"real":[77],"needs,":[78],"we":[79],"propose":[80],"a":[81,105,110,120],"framework":[82],"can":[84,164],"trace":[85],"vulnerability-relevant":[87,129,167,186],"file":[88,168],"for":[89],"each":[90],"disclosed":[91],"vulnerability.":[92],"Our":[93,139],"approach":[94,163],"uses":[95],"NVD":[96,137],"descriptions":[97],"with":[98,109,149,166],"metadata":[99],"as":[100],"inputs,":[102],"employs":[104],"series":[106],"strategies":[108],"LLM":[111],"model,":[112],"search":[113],"engine,":[114],"heuristic-based":[115],"text":[116],"matching":[117],"method":[118],"deep":[121],"learning":[122],"classifier":[123],"recommend":[125],"most":[127],"likely":[128],"file,":[130],"effectively":[131],"enhancing":[132],"completeness":[134],"existing":[136],"data.":[138],"experiments":[140],"confirm":[141],"efficiency":[144],"proposed":[147],"framework,":[148],"CodeBERT":[150],"achieving":[151],"0.92":[152],"AUC":[153],"0.85":[155],"MAP,":[156],"our":[158,162,175,177],"user":[159],"study":[160],"proves":[161],"help":[165],"effectively.":[170],"To":[171],"best":[173],"knowledge,":[176],"work":[178],"is":[179],"first":[181],"one":[182],"focusing":[183],"tracing":[185],"files,":[187],"laying":[188],"groundwork":[190],"building":[192],"vulnerability-aware":[194],"materials.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}