Favia: Forensic Agent for Vulnerability-fix Identification and Analysis
Identifying vulnerability-fixing commits corresponding to disclosed CVEs is essential for secure software maintenance but remains challenging at scale, as large repositories contain millions of commits of which only a small fraction address security issues. Existing automated approaches, including traditional machine learning techniques and recent large language model (LLM)-based methods, often suffer from poor precision-recall trade-offs. Frequently evaluated on randomly sampled commits, we uncover that they are substantially underestimating real-world difficulty, where candidate commits are already security-relevant and highly similar. We propose Favia, a forensic, agent-based framework...
| Authors | André Storhaug, Jiamou Sun, Jingyue Li |
|---|---|
| Primary category | cs.SE |
| Published | 13 February 2026 |
| Last updated at source | 13 February 2026 |
Models and datasets referencing this paper
- andstor/cvevc_commitsDataset
- andstor/cvevc_candidatesDataset
- andstor/cvevc_cve_commit_mappingsDataset
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 18 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.