C/C++ Vulnerability Data Set Generation Framework using a Parser and LLM

Open-source software can reduce the cost of code use and development; however, it can also introduce vulnerabilities. Machine learning methods show promise for finding and fixing vulnerabilities in source code, but require a large amount of labeled data for training. We provide a data set generation framework for $\mathrm{C} / \mathrm{C}++$ code that will identify code commits that patch vulnerabilities and provide the patched and unpatched function. The framework uses a large language model to determine if the commit patches a vulnerability, then a custom parser to extract the function before and after the patch. Our data set provides over 18,000 functions from 12 repositories. Random sampling and human verification estimate the accuracy at $\mathbf{8 9 \%}$.