# TMVDPatch: A Trusted Multi-View Decision System for Security Patch Identification
## 1 Introduction
However, in addition to the security patches, there are a large number of non-security patches in the code changes submitted by the vendors. Additionally, non-security patches may include bug fixes and functional patches. Table 1 summarizes the related work in the security patch identification. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Ref**} & \multirow{2}{*}{**Year**} & \multirow{2}{*}{**Program**} & \multirow{2}{*}{**Labeled Data**} & \multirow{2}{*}{**Open Source**} & \multirow{2}{*}{**Open Source**} & \multirow{2}{*}{**Method**} & \multirow{2}{*}{**Object of Study**} \\  & & & & & & & & \\  & & & & & & & & \\ \hline
[6] & 2019 & C/C++ & 3272 & ✗ & ✗ & Heuristics & Code Diff \\
[7] & 2021 & C/C++ & 40,523 & Part & ✗ & Deep learning & Commit Message \& \\
[8] & 2020 & C/C++ & 9247 & ✓ & ✓ & Heuristics & Code Diff \\  & & & & & & Classic & Commit Message \& \\
[9] & 2018 & JAVA & 2715 & ✓ & ✗ & Machine & Code Diff \\  & & & & & & Learning & & The prior and \\
[10] & 2021 & JAVA & 1950 & Part & ✗ & Deep learning & posterior versions of source code in the commit \\
[11] & 2020 & C/C++ & 82,403 & Invalidation & ✓ & Deep learning & code diff \\
[12] & 2019 & C/C++ & 82,403 & Invalidation & ✓ & Deep learning & Commit Message \& \\  & & & & & & Code Diff \\
[13] & 2021 & C/C++ & 38,041 & ✓ & ✓ & Deep learning & posterior versions of source code in the commit \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The related work in the security patch identification. Therefore, how to efficiently identify security patches for vulnerability fixes in a large number of code change submissions is crucial. To solve this problem, this paper proposes an efficient and reliable security patch identification system called TMVDPatch. In this paper, we propose a multi-view decision system for security patch identification that accounts for classification uncertainty using D-S(Dempster-Shafer) evidence theory. The method parses the control dependency graph (CDG) and data dependency graph (DDG) of the source code, and combines the graph diff with commit message to capture the semantic information and syntax information of the code change. And then, the system uses the results as evidence in the multi-view learning framework, and determines the relevance of different views as the weight of evidence input according to the Grey Relational Analysis method with self-learning correction. Using this approach to self-learning and correction, we can improve the ability of trusted multi-view decision-making. In order to effectively evaluate the identification ability of the system, we conducted related experiments on the large-scale real patch dataset called PatchDB [16]. The experimental results show that we can achieve a comprehensive accuracy of 85.29%, and the F1 score is 0.9001. At the same time, the precision is 85.42% and the recall is 95.11%. In summary, the contributions of this work are summarized below:  
1. We first propose a trusted multi-view security patch identification system called TMVDPatch. The system adopts a multi-view evidence fusion strategy. Based on the subjective uncertainty learned from each view, the evidence is weighted by the Grey Relational Analysis method to provide credible and interpretable decisions, thereby achieving efficient and scientific security patch identification. 2. We propose a representation method for the semantic and syntactic information of security patches. The method regards the multi-view evidence, including control dependency information, data dependency information and description information, so as to comprehensively represent the semantic and syntax information of security patches. Compared to learning from commit message alone, the multi-view representation method shows an excellent ability in control-dependent and data-dependent complementary information. 3. We conduct a large number of experiments on the model hyperparameter settings and importance evaluation.