MSc thesis supervision: Finding Vulnerable Code Clones from Known Vulnerability Cases

Abstract

Code cloning can cause security issues when vulnerable code is copied, modified or left unpatched in other parts of a software system. This thesis investigates how known vulnerability cases can be used to search for potential vulnerable code clones in open-source codebases. First, it examines how to delimit the vulnerability-bearing code, then how to transform that code into detector-specific input, and finally how to assess whether retrieved candidates still retain the vulnerable logic.

The thesis defines a seed-based workflow based on public Common Vulnerabilities and Exposures (CVE) cases. For each case, a seed code region is selected manually from the vulnerable pre-patch code with the aid of the patch. Detector-specific seeds are then derived from this common region and used with two clone detection approaches, where the first is NiCad, which is a configurable near-miss clone detector, and the second is VUDDY, which is a function-level vulnerability clone detector. Retrieved candidates are collected and evaluated manually using a framework that separates code similarity from vulnerability preservation.

The main detector runs produced 15 raw reports, which were reduced to five unique candidate groups following pooling. All five groups were evaluated manually. None of the assessed candidates retained the vulnerable logic. Four candidates were syntactically related to the seed code region but represented patched variants, while one candidate was not meaningfully related.

The results show that detector output should be treated as candidate retrieval rather than confirmation of vulnerable code clones. They also show that seed construction, detector granularity, configuration choices, candidate pooling and manual vulnerability assessment are all important when using clone detection approaches for the analysis of vulnerable code clones.

My role as supervisor

I was the student's university supervisor at IDA's Software and Systems division, with Ulf Kargén as examiner. I reviewed and steered the scientific writing up to the final thesis.