# TMVDPatch: A Trusted Multi-View Decision System for Security Patch Identification
## 2 Background and Related Work
### Security Patch Identification
[15] propose a new approach to transform the security patch localization search problem into a ranking problem. Therefore,they propose a new technique for ranking commits related to vulnerabilities and implement a ranking-based security patch localization method called PatchScout. With the rise of artificial intelligence, recent research on security patch identification primarily uses machine learning methods. [PERSON] and [PERSON] [9] treat code changes as documents written in natural language and classifies them using standard text classification methods. [PERSON] et al. [12] propose a patch classification tool based on hierarchical deep learning called PatchNet.They learn relevant features from commit message and code diff, with experimentally verified in Linux kernel patch identification. In order to obtain a deep understanding of the vector representation of code changes, [PERSON] et al. [11] propose a neural network model based on deep learning called CC2 Vec. They use an attention mechanism to model the hierarchy of code changes, producing a distributed representation of code diff. [PERSON] et al. [7] propose a security patch identification system based on deep learning called SPI. The system consists of two neural networks: one is a neural network for commit message, which uses commit message for word vector pre-training; the other is a neural network for code diff, which uses subtractive code change and additive code change to learn. ```
1 diff-git/a/libwformat/max.cb/libwformat/max.c
2 index5 cb0 cs4782..d67 db4a76100644
3...a/libwformat/max.c
4++b1 libwformat/max.c
50e-893,6+893.100 intar_write_frame(AVFormatContext*,AVPacket*pkt)
6 return1;
7}
8
9*ret=do_packet_auto_bsf(s._pkt)
10*if(ret<=0)
11#returnret$
12+
13 ifFF_API_COMPUTE_PKT_PIELDS2&&FF_API_LAV_AVCTX
14 ret=compute_numer_pkt_fields(s.s-streams[pkt->stream_index],pkt);
```  
Listing 2: An example of non-security patch in FFmpeg. However, the above work focuses solely on code diff and does not consider the overall information of the source code before and after modification. To solve this problem, [PERSON] et al. [10] propose a new method called Commit2 Vec based on code2 vec [17] to capture code change representation from the source code. By analyzing the prior and posterior versions of source code in the commit, the method compares the differences observed in the abstract syntax tree (AST) before and after the code change, and implements the vector representation of AST changes based on neural networks. At the same time, [PERSON] et al. [13] also propose a security patch identification system called PatchRNN. They use the TextRNN model to obtain the vector representation of commit message. And then, they use the prior and posterior versions of source code in the commit to learn code change representation. Finally, they aggregate them and realize the identification of security patches based on a fully connected network. In addition to heuristic methods and machine learning, [PERSON] et al. [14] propose a formal method for security patch identification based on symbolic interpretation. They define security patches from a formal perspective for the first time. Moreover, they propose a tool for security patch identification called SPIDER, which performs security patch identification through the source code of the original version and the patched version. Therefore, based on the analysis of the above work, the key of source code patch analysis is to learn the syntax and semantics of code patches, rather than simply treating them as ordinary text. Learning the control and data dependencies in the source code is crucial for obtaining the essential information of security patches. This paper utilizes commit message and source code of the original version and the patched version to capture a more comprehensive patch representation. In our work, we parse the control dependency graph and data dependency graph of the source code, and combine the graph diff with commit message to capture the semantic information and syntax information of the code change.