A C/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries

By Jiahao Fan, Yi Li, Shaohua Wang, Tien Nhut Nguyen. IEEE Working Conference on Mining Software Repositories, 2020

645 citations recorded by the source corpus.

We collected a large C/C++ code vulnerability dataset from open-source Github projects, namely Big-Vul. We crawled the public Common Vulnerabilities and Exposures (CVE) database and CVE-related source code repositories. Specifically, we collected the descriptive information of the vulnerabilities from the CVE database, e.g., CVE IDs, CVE severity scores, and CVE summaries. With the CVE information and its related published Github code repository links, we downloaded all of the code repositories and extracted vulnerability related code changes. In total, Big-Vul contains 3,754 code vulnerabilities spanning 91 different vulnerability types. All these code vulnerabilities are extracted from 348 Github projects. All information is stored in the CSV format. We linked the code changes with the CVE descriptive information. Thus, our Big-Vul can be used for various research topics, e.g., detecting and fixing vulnerabilities, analyzing the vulnerability related code changes. Big-Vul is publicly available on Github.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/7eebae9c294f68d8061d921e7c2bb76a06b15889

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Xinyun Chen
2. Chakkrit Kla Tantithamthavorn
3. David A. Wagner
4. Michael Fu
5. Shaohua Wang
6. Tien Nhut Nguyen
7. Yizheng Chen
8. Yi Li

In Information Systems

1. Shaohua Wang
2. Yi Li
3. Tien Nhut Nguyen
4. Xinyun Chen
5. Guru Prasad Bhandari
6. Leon Moonen
7. Chakkrit Kla Tantithamthavorn
8. Amara Naseer

In Signal Processing

1. Xinyun Chen
2. Shaohua Wang
3. Tien Nhut Nguyen
4. Yi Li
5. Premkumar T. Devanbu
6. Swarat Chaudhuri
7. C. Jermaine
8. Vijayaraghavan Murali

Citations in the corpus

• CVEfixes: automated collection of vulnerabilities and their fixes from open-source software (2021, methodology): “[27] curated a dataset of 1282 commit fixes to vulnerabilities from 205 open-source Java projects obtained from NVD and project-specific web resources, and Fan and Nguyen [28] curated a C/C++ code vulnerability dataset named Big-Vul that corresponds with code changes and CVE database entries from 20”
• LineVul: A Transformer-based Line-Level Vulnerability Prediction (2022, background): “[16]’s dataset is the only vulnerability dataset that provides line-level ground-truths (i.”
• Vulnerability detection with fine-grained interpretations (2021, methodology): “It took 23, 7, 10 hours to train IVDetect on Fan, Reveal, and FFMPeg+Qemu datasets.”
• DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection (2023, methodology): “To label vulnerable functions, we follow the methodology used in ReVeal [4], BigVul [8], CrossVul [18], and CVEFixes [2], which considers a function vulnerable if it was changed by the vulnerability-fixing commit.”