The History Is the Detector: Executing CVE Patch History, End-to-End
BUGSTONE-E2E is a framework that transforms vulnerability history into executable detection rules. It mines reusable rules from verified fixing commits, capturing scan anchors, fix semantics, and CVE provenance, organized by CWE and language. Detection uses a funnel-shaped pipeline: early stages process a large pool of candidates using lightweight analysis, later stages apply increasingly capable and expensive models to a shrinking set of targets. It enumerates call sites matching rule anchors using Tree-sitter, then removes benign sites using lightweight heuristics.
Public vulnerability databases contain rich information about known software flaws, including weakness types, affected components, and related patches. Fixing commits provide exact code changes that removed these flaws. However, these records are documented mainly for human inspection rather than automated reuse, so the same unsafe conditions may still exist elsewhere in code without a known advisory. BUGSTONE-E2E addresses this by converting vulnerability history into executable detection rules and validating their findings. The framework mines reusable rules from verified fixing commits, capturing scan anchors, fix semantics, and CVE provenance, organized by CWE and language. Detection follows a funnel-shaped pipeline: early stages process a large pool of candidates using lightweight analysis, while later stages apply increasingly capable and expensive models to a shrinking set of targets. Specifically, BUGSTONE-E2E first enumerates call sites matching rule anchors using Tree-sitter, then removes benign sites using lightweight heuristics.
The framework leverages Tree-sitter for syntactic anchor matching and a staged pipeline that balances scalability and precision. By extracting fix semantics and CVE provenance from historical patches, it creates reusable, CWE- and language-specific detection rules. The funnel design suggests a trade-off between computational cost and detection accuracy, with lightweight heuristics filtering candidates before more expensive models are applied.
Automated vulnerability detection from patch history could reduce reliance on manual code review and improve software security at scale. This approach may be particularly valuable for large codebases and legacy systems where known vulnerability patterns persist without formal advisories. Adoption could shift security practices toward continuous, history-driven scanning.
For organizations, BUGSTONE-E2E could lower the cost of vulnerability detection by automating the reuse of historical fix knowledge. It may reduce false positives through staged filtering and enable proactive identification of flaws before they are exploited. Potential markets include security tooling, DevSecOps platforms, and enterprise software assurance.
Observable next signals include open-source release or documentation of BUGSTONE-E2E, benchmarks against existing static analysis tools, and integration into CI/CD pipelines. Further research may extend the framework to additional languages and CWE categories, or incorporate more advanced models in later pipeline stages.