Efficient and Robust Security-Patch Localization for Disclosed OSS Vulnerabilities with Fine-Tuned LLMs in an Industrial Setting
Dezhi Ran, Lin Li, Liuchuan Zhu, Yuan Cao, Landelong Zhao, Xin Tan, Guangtai Liang, Qianxiang Wang, Tao Xie · 2025
Security-patch localization, which links disclosed vulnerabilities in open-source software (OSS) to corresponding patches, has become a practical technique to mitigate the risk of OSS vulnerabilities in a timely manner. While existing approaches extensively focus on estimating the correlation between individual patches and Common Vulnerabilities and Exposures (CVEs), they often fail to address two major industrial requirements that make a tool of security-patch localization desirable in industrial settings: (1) efficiency when inspecting an enormous number of commits per vulnerability and (2) robustness to handle confusing patches (related but non-fixing commits). Toward addressing the preceding industrial requirements, in this paper, we report our experiences of developing and deploying Taper, a two-stage approach for efficiently and robustly locating security patches via mining the temporal relations among commits and CVEs. In the first stage, Taper extracts the information of the fixed version and the affected version from CVE descriptions to narrow down the inspection scope of commits, thus significantly improving the efficiency. In the second stage, Taper collects temporally co-located patches around the genuine security-patch commit as hard negative examples for security-patch localization. By fine-tuning a language model with these hard negative samples, Taper avoids recognizing confusing patches as security patches, thus improving patch-localization precision and robustness. We evaluate Taper against 2,128 CVEs from 978 OSS projects, which have a balanced distribution of programming languages and are consistent with industrial settings. Evaluation results show that Taper substantially outperforms a state-of-the-art approach named PatchFinder, improving the absolute MRR and Recall@1 by 0.422 and 0.541, respectively. Taper has been deployed at Huawei Cloud since October 2024. During 800 hours of operation, Taper helps locate over 52,140 security patches, providing daily service of security-patch localization for the Huawei company and Huawei Cloud users. We summarize three major lessons learned from developing and deploying Taper.