# TMVDPatch: A Trusted Multi-View Decision System for Security Patch Identification
## 1 Introduction  
In recent years, cyber attacks have emerged in a constant stream within turbulent network environment, and software vulnerabilities are still the main threat to network security. The most effective way to address this threat is still to patch the vulnerability. According to the Snyk report [1], approximately 35% of the vulnerabilities are fixed within 20 days, while 36% of the vulnerabilities require 70 days or more, resulting in an average resolution time of 68 days. At the same time, its 2022 Open Source Security Trends Analysis [2] finds that supply chain attacks are increasingly prevalent. The entire supply chain is an attractive attack vector because cyber attackers can attack vulnerabilities in development pipelines without changing software repositories. This means that after vulnerability discovered, it often requires a lot of time for vulnerability patch, and the security threat brought by the response time to address vulnerability is greatly amplified in software supply chain attacks. For instance, a high impact remote code execution vulnerability (CVE-2021-44228 ([[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)]([https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)) (accessed on December 2021)) was disclosed in Apache Log4j2 in 2021. Apache Log4j is the foundational logging component, with widespread use across numerous applications. According to the arms report [3], attackers around the world have been trying to exploit the vulnerability since its discovery. Numerous vendors have observed attempts to distribute coin miners,ransomware, remote access Trojans, web shells, and botnet malware. In just one week, approximately 35% of users were active attacks through the vulnerability, and 31% were exposed to Log4j-related threats on unmanaged devices. The security vendor said it had observed as many as 30,000 attack attempts against its users. Other vendors have reported similar activity. At the same time, according to the arms report [4], the Log4j versions released from 2013 to 2021 have vulnerabilities, the library is ubiquitous. To go a step further, it may take years to get rid of the danger, and a large number of programs may never be patched. Therefore, the time difference between vulnerability discovery and actual vulnerability patch is extremely important for the current state of network security. After the manufacturer publishes the announcement of the vulnerability patch, the developers often package and upload the code changes with descriptions through submission. Ideally, after the vendor releases the patch, other projects involving this vulnerability will be updated with the patch in a timely manner. But the reality is that there is frequently a significant delay between the actual fix and the release of the patch. In order to fix the vulnerability, the maintainers of each project need to monitor the patch announcement released by the manufacturer, so as to complete the emergency patching in time. Unfortunately, the silent fix of the vulnerability poses a significant challenge. Out of fear of reputation and the security threat brought by the vulnerability disclosure, vendors often secretly implement vulnerability fixes without assigning the CVE numbers, or even avoid descriptions of vulnerabilities in the commits. According to GitHub's 2019 report [5], about 7.6 million security alerts were fixed, primarily through code changes. Meanwhile, only 12,174 CVEs were disclosed in the same year. As a result, a large number of security patches will not be associated with CVE(Common Vulnerabilities and Exposures) numbers, but will be silently fixed without official reports. Despite this situation, attackers can still directly analyze the code differences to find related vulnerabilities and develop tools for secret exploitation.