论文标题
关于自动化程序维修工具建议的代码审阅者对候选安全补丁的接受
On the acceptance by code reviewers of candidate security patches suggested by Automated Program Repair tools
论文作者
论文摘要
背景：自动化程序维修工具提供的补丁的语义正确性（APR）的测试和验证已引起了很多关注。然而，人类补丁审稿人最终接受或拒绝对现实世界项目的建议补丁受到了有限的关注。目的：为了解决这个问题，我们计划调查APR工具建议的（可能不正确的）安全补丁。我们还想调查是否知道一个据称专业工具制作的补丁是否确实改变了人类审稿人的决定。方法：在第一阶段，使用平衡的设计，我们向人类审稿人提出了APR工具提出的针对不同漏洞提出的补丁的组合，并要求审稿人采用或拒绝提出的补丁。在第二阶段，我们告诉参与者，某些提议的补丁是由安全专用工具（即使工具实际上是“正常” APR工具）生成的，并衡量人类审阅者是否会更改其采用或拒绝补丁的决定。局限性：实验将在学术环境中进行，并保持权力，它将集中在有限的流行APR工具和流行脆弱性类型上。
Background: Testing and validation of the semantic correctness of patches provided by tools for Automated Program Repairs (APR) has received a lot of attention. Yet, the eventual acceptance or rejection of suggested patches for real world projects by humans patch reviewers has received a limited attention. Objective: To address this issue, we plan to investigate whether (possibly incorrect) security patches suggested by APR tools are recognized by human reviewers. We also want to investigate whether knowing that a patch was produced by an allegedly specialized tool does change the decision of human reviewers. Method: In the first phase, using a balanced design, we propose to human reviewers a combination of patches proposed by APR tools for different vulnerabilities and ask reviewers to adopt or reject the proposed patches. In the second phase, we tell participants that some of the proposed patches were generated by security specialized tools (even if the tool was actually a `normal' APR tool) and measure whether the human reviewers would change their decision to adopt or reject a patch. Limitations: The experiment will be conducted in an academic setting, and to maintain power, it will focus on a limited sample of popular APR tools and popular vulnerability types.
