## 3 Dataset Creation Process
### Filtering Results Through Keywords
\begin{table}
\begin{tabular}{l l l} \hline
**Type of Vulnerability** & **Assigned CVE (If** & **Severity [38] * \\  & **Available) ** \\ \hline Privilege Escalation & CVE-2019-16303 & Critical \\ \hline XXE (XML External Entity Injection & CVE-2019-9658 & Critical \\ \hline Remote Code Execution (RCE) & CVE-2017-0702 & Critical \\ \hline SQL Injection (SQL Injection) & N/A & Critical \\ \hline XSS (Cross-site Scripting) & N/A & Critical \\ \hline Buffer Overflow & N/A & Critical \\ \hline Directory Traversal & N/A & High \\ \hline Information Disclosure & CVE-2017-13309 & Medium \\ \hline Unauthorized Access & CVE-2020-8908 & Low \\ \hline \end{tabular}
\end{table} 
Table 3: Examples of covered vulnerabilities in our dataset with CVEs. ically analyzing commit messages, the approach leverages these regular expressions to detect potentially vulnerable code changes efficiently. The regular expression patterns are case-insensitive (denoted by (?i)) and include variations of terms to account for different formatting styles. Additionally, they incorporate optional and alternative spellings (e.g., unauthor[z | s]ed) and wildcard matches (e.g., vulner[a-z]+) to ensure a comprehensive search. The \"Rule\" categorizes the types of vulnerabilities targeted, while the \"Regular Expression\" column contains patterns that identify key terms or phrases related to these vulnerabilities. The rules are broadly classified into two categories:  
1. General Vulnerabilities: This includes patterns for common security issues, such as Denial of Service (DoS), Cross-Site Scripting (XSS), SQL Injection (SQLi), and Remote Code Execution (RCE). Regular expressions for these vulnerabilities are structured to capture variations in terminology and case sensitivity, ensuring comprehensive detection. 2. Mobile-Specific Vulnerabilities: These patterns focus on issues prevalent in mobile application development, such as sensitive data exposure, improper validation, and the use of hard-coded credentials. The expressions aim to enhance security in mobile software environments by addressing mobile-specific risks. For instance, the regular expression (?i)(denial.of.service | >>XXE>| remote.code. execution|...) matches a variety of keywords indicative of general vulnerabilities, including technical terms like \"XXE\" (XML External Entity) and broader descriptors like \"unauthorized\" or \"insecure.\" Similarly, the expression for mobile vulnerabilities, (?i)(information.exposure| sensitive.(? :information| data| communication)|...), identifies concerns such as the exposure of personal information or the use of shared resources without proper controls. By applying these rules, the filtering mechanism ensures that only commits that are highly likely to contain vulnerability-related fixes or changes are selected for further analysis. This targeted approach reduces noise and improves the efficiency of the dataset construction process. The regular expressions in Table 2 are used to search the commit messages of Android application repositories on GitHub, filtering commits that include vulnerable code. We utilized initial training data from March 2016 to February 2023, aligning with Google's open-source GitHub data. Within the commit dataset, we identified that 20,004 commits are related to vulnerabilities. It is important to note that this dataset can be regularly updated based on the data available in Google's dataset, allowing us to keep our codebase aligned with newly discovered and fixed vulnerabilities.