# TMVDPatch: A Trusted Multi-View Decision System for Security Patch Identification
## 2 Background and Related Work  
### Security Patch Identification  
A software patch is a record of changes made to source code between two versions, and the patch file is generated by the diff command. A patch file consists of \"blocks\" of code modifications (parts prefixed with @@) that indicate the location of modifications, which represent code patches by recording additions and deletions of the code lines. The two \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Ref** & **Year** & **Program** & **Labeled Data** & **Open Source** & **Open Source** & **Method** & **Object of Study** \\ \hline
[14] & 2020 & C/C++ & 341,767 & ✗ & ✗ & ✗ & Symbolic &
\begin{tabular}{c} The prior and \\ posterior versions of \\ source code in \\ the commit \\ \end{tabular} \\
[15] & 2021 & C/C++ & \begin{tabular}{c} 3,329,286 \\ Sample Pairs \\ \end{tabular} & ✗ & ✗ & \begin{tabular}{c} \(\mathcal{X}\) \\ \end{tabular} & \begin{tabular}{c} \(\mathcal{X}\) \\ \end{tabular} & \
\begin{tabular}{c} Symbolic \\ Interpretation \\ \end{tabular} &
\begin{tabular}{c} posterior versions of \\ source code in \\ the commit \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._main types of software patches are security patches and non-security patches. Non-security patches include primarily bug fixes and functional patches. Bug fix patches are mainly used for program optimization, and functional patches are mainly used to add new functions.This paper focuses on identifying security patches that fix program vulnerabilities. In order to clearly illustrate the security patch and the non-security patch, we provide the corresponding cases in Listings 1 and 2. Listing 1 is an example of security patch for an integer underflow vulnerability (CVE-2019-13602), which prevents a vulnerability related to integer underflow in function MP4_EIA608_Convert by modifying the constraints of the i_bytes local variable (lines 16 and 17). Listing 2 shows a non-security patch in the FFmpeg software (9e588125193115189b5a609 eef6 af678a55f6 ecf). This patch enables FFmpeg to automatically call the check_bitstream interface when running writing_frame (the call to check_bitstream is encapsulated in the do_packet_auto_bsf), thereby improving the running efficiency of FFmpeg. ```
1 diff -git a/modules/demux/mp4/mp4.c b/modules/demux/mp4.c b/modules/demux/mp4/mp4.c
2 index 774d6e13c383f36b41710064
3- a/modules/demux/mp4/mp4.c
4++ b/modules/demux/mp4/mp4.c
50e -536,10+536,10@staticblock_+ NP4_EIA608_Convert( block_t * p_block ) ) while(i_bytes >= 2 );
6
7
8
9/ + cdt2 is optional */
10
11 if (i_remaining >= 10&&
12(i_bytes <= i_remaining)&&
13{i_bytes <= cdt2;kp_read[4],4]}
14
15
16
17 if (10 <= i_bytes == c+i_remaining &&
18{i_bytes == cdt2;kp_read[4],4]}
19
20p_read += 8;
21
22
23i_bytes == 8;
```  
**Listing 1** Example of security patch for an integer underflow vulnerability (CVE-2019-13602). At present, related work has been done on the identification of security patches. This paper summarizes the related work in this field in recent years' study in Table 1.  
Traditional security patch identification mainly adopts heuristic method. [PERSON] et al. [6] propose the effective feature for distinguishing security patches and non-security patches. There are 61 features, including basic features, syntax features and semantic features. On this basis, they use a voting algorithm to integrate five classic classification algorithms, Random Forest, Bayes Net, SGD (Stochastic Gradient Descent), SMO (Sequential Minimal Optimization), and Bagging. The experimental results show that the model has a TPR (True positive rate) of 79.6% and an FPR (False positive rate ) of 41.3%. [PERSON] et al. [8] achieve security patch identification using commit message and code diff information for identification. Specifically, they propose a semi-supervised method with co-training to train two classifiers with commit messages and code changes, respectively, addressing the unlabeled problem of patch data. [PERSON] et al.