Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, including commit messages, code changes and issue reports for vulnerability-fixing commit classifica- tion. Our experimental results show that VulCurator outperforms the state-of-the-art baselines up to 16.1% in terms of F1-score. VulCurator tool is publicly available at https://github.com/ntgiang71096/VFDetector and https://zenodo.org/record/7034132#.Yw3MN-xBzDI, with a demo video at https://youtu.be/uMlFmWSJYOE.

翻译：开放源码的脆弱程度管理程序(OSS)在当今非常重要,因为发现的OSS脆弱性管理程序随着时间推移而不断增加。监测脆弱程度固定承诺是防止脆弱性开发的标准程序的一部分。但是,由于可能有大量的审查承诺,人工检测脆弱程度固定承诺是耗时的。最近,提出了许多技术来自动检测脆弱程度固定承诺使用机器学习。这些解决方案要么:(1)没有使用深层次的学习,要么在有限的信息来源方面使用深层次的学习。本文提议了VulCurator,这是利用更丰富的信息来源的深层次学习的工具,包括信息、代码更改和发布关于脆弱性固定承诺等级的报告。我们的实验结果表明,VulCurator在F1-score方面超过了16.1%的状态基线。VulCurator工具可在https://githuub.com/ntiang/7196/VFsseador和https://zenodo.org/record/record701343/MMMMMMMM-DO上一个视频的MWAWS-MZ/DVDO.YwMZO.YWMZ-DO)。