# TMVDPatch: A Trusted Multi-View Decision System for Security Patch Identification
## 6 Discussion and Future Work  
At present, the identification of security patches based on neural networks is often not interpretable and cannot fully capture patch information. To solve this problem, this paper proposes an efficient and reliable security patch identification system called TMVD-Patch. The system obtains evidence from message commit and code diff views respectively, and models the uncertainty of each view based on the D-S evidence theory, thereby providing credible and interpretable security patch identification results. On this basis, this paper performs weighted training on the original evidence based on the Grey Relational Analysis method to improve the credible multi-view decision-making ability. Experimental results show that the multi-view learning method exhibits excellent capabilities in terms of control-dependent and data-dependent complementary information, and the model exhibits strong robustness against hyperparameter settings. TMVDPatch outperforms other models in all evaluation metrics, achieving an accuracy of 85.29% and a F1 score of 0.9001, clearly verifying the superiority of TMVDPatch in terms of accuracy, scientificity, and reliability.  
One of the limitation of our proposed method is that it depends on the analytical results obtained by the Joern tool, which may not be accurate or complete for some code structures. A possible direction for future work is to incorporate evidence from other views, such as syntactic, semantic or structural features of the code, into our framework to enhance the robustness and generalization ability of our model. Another limitation of our method is that it only handles patches that involve single file changes. This may miss some important information or introduce some errors when dealing with patches that span multiple files and have function calls between them. To overcome this challenge, future work can improve the analysis tool to capture the dependencies and interactions between multiple files and handle multi-file patches more effectively.  
The main problem we address is how to provide credible and interpretable decisions for security patch identification. Therefore, we do not discuss neural network models in detail in this paper. In our work, we only use an attention-based BLSTM model to obtain evidence and we do not compare it with other neural network models. Future work can explore neural network model design for this task. For example, different neural network models can be used as multiple views and then investigate their complementarity or conflict situations.  
In addition to security patch identification, the framework proposed in this paper also offers potential implications for code analysis in other domains. Our framework can be extended to new solutions for other applications, such as malware detection.  
Conceptualization, X.Z. and W.L.; Methodology, X.Z., J.P. and Z.S.; Software, X.Z., J.P., F.L. and G.L.; Validation, J.W.; Formal analysis, Z.S.; Investigation, W.L. and G.L.; Resources, Z.S. and F.L.; Data curation, F.Y. and J.X.; Writing--original draft, X.Z.; Writing--review & editing, X.Z.; Visualization, J.X. All authors have read and agreed to the published version of the manuscript. This research was funded by the National Natural Science Foundation of China 61802433 and 61802435.  
Not applicable.  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Model** & **Accuracy** & **Precision** & **Recall** & **F1** \\ \hline \(MV_{cat}\) & 0.7798 & 0.7877 & 0.9362 & 0.8555 \\ \(MV_{sum\_64}\) & 0.7329 & 0.8409 & 0.7601 & 0.7985 \\ \(MV_{sum\_128}\) & 0.7574 & 0.8100 & 0.8520 & 0.8302 \\ \(MV_{avg\_64}\) & 0.7736 & 0.8503 & 0.8109 & 0.8301 \\ \(MV_{avg\_128}\) & 0.7615 & 0.7783 & 0.9195 & 0.8430 \\ TMVD-NG & 0.8400 & 0.8502 & 0.9350 & 0.8906 \\
**TMVDPatch** & **0.8529** & **0.8542** & **0.9511** & **0.9001** \\ \hline \hline \end{tabular}
\end{table}
Table 4: The results of different ensemble methods.