DeepCVA: Automated Commit-level Vulnerability Assessment with Deep
  Multi-task Learning
  It is increasingly suggested to identify Software Vulnerabilities (SVs) in
code commits to give early warnings about potential security risks. However,
there is a lack of effort to assess vulnerability-contributing commits right
after they are detected to provide timely information about the exploitability,
impact and severity of SVs. Such information is important to plan and
prioritize the mitigation for the identified SVs. We propose a novel Deep
multi-task learning model, DeepCVA, to automate seven Commit-level
Vulnerability Assessment tasks simultaneously based on Common Vulnerability
Scoring System (CVSS) metrics. We conduct large-scale experiments on 1,229
vulnerability-contributing commits containing 542 different SVs in 246
real-world software projects to evaluate the effectiveness and efficiency of
our model. We show that DeepCVA is the best-performing model with 38% to 59.8%
higher Matthews Correlation Coefficient than many supervised and unsupervised
baseline models. DeepCVA also requires 6.3 times less training and validation
time than seven cumulative assessment models, leading to significantly less
model maintenance cost as well. Overall, DeepCVA presents the first effective
and efficient solution to automatically assess SVs early in software systems.
