This paper presents a framework that selectively triggers security reviews
for incoming source code changes. Functioning as a review bot within a code
review service, the framework can automatically request additional security
reviews at pre-submit time before the code changes are submitted to a source
code repository. Because performing such secure code reviews add cost, the
framework employs a classifier trained to identify code changes with a high
likelihood of vulnerabilities. The online classifier leverages various types of
input features to analyze the review patterns, track the software engineering
process, and mine specific text patterns within given code changes. The
classifier and its features are meticulously chosen and optimized using data
from the submitted code changes and reported vulnerabilities in Android Open
Source Project (AOSP). The evaluation results demonstrate that our
Vulnerability Prevention (VP) framework identifies approximately 80% of the
vulnerability-inducing code changes in the dataset with a precision ratio of
around 98% and a false positive rate of around 1.7%. We discuss the
implications of deploying the VP framework in multi-project settings and future
directions for Android security research. This paper explores and validates our
approach to code change-granularity vulnerability prediction, offering a
preventive technique for software security by preemptively detecting vulnerable
code changes before submission.

本文提出了一个能够有选择地触发源代码的安全审查的框架，通过作为代码审查服务中的审查机器人，该框架能够在代码更改提交到源代码存储库之前，在提交前自动请求额外的安全审查。该框架使用经过训练的分类器来识别具有漏洞的代码更改，采用多种类型的输入特征分析审查模式、跟踪软件工程过程以及挖掘给定代码更改中的特定文本模式。经过数据优化后的分类器及其特征使用了来自所提交代码更改以及 Android 开源项目（AOSP）中报告的漏洞的数据。评估结果表明，我们的漏洞预防（VP）框架能够在数据集中识别出约 80% 的引起漏洞的代码更改，精度比大约为 98%，误报率约为 1.7%。本文探讨了在多项目环境中部署 VP 框架的影响以及 Android 安全性研究的未来方向。本文探索和验证了我们对代码更改粒度漏洞预测方法的方法，并提供了一种在提交之前预防性地检测到有漏洞代码更改的软件安全技术。