MSc thesis supervision: Finding Vulnerable Code Clones from Known Vulnerability Cases
- Period
- Jan – Jul 2026
- Organisation
Linköping University, IDA (Software and Systems)- Role
- Supervisor (examiner: Ulf Kargén)
- Location
- Linköping University, B-huset (IDA)Campus Valla, 581 83 Linköping, Sweden
- Posted
Supervised an MSc thesis on finding vulnerable code clones from public CVE cases: constructing seed code regions from patches, comparing the NiCad and VUDDY clone detectors, and manually assessing whether candidates still contain the vulnerability.
- Student: Daniel Andersson
- 30 ECTS, 2026
When vulnerable code is copied and left unpatched elsewhere, a fixed CVE can live on in other places. The thesis built a seed-based workflow on public CVE cases. For each case, a seed code region is selected from the vulnerable pre-patch code, guided by the patch. Detector-specific seeds are derived from it for NiCad (a configurable near-miss clone detector) and VUDDY (a function-level vulnerability clone detector).
The candidates were assessed manually with a framework that separates code similarity from vulnerability preservation. The 15 raw reports reduced to five unique candidate groups. None retained the vulnerable logic: four were patched variants and one was unrelated.
The conclusion matters for practice. Clone-detector output is candidate retrieval, not confirmation. Seed construction, detector granularity, configuration, pooling and manual assessment all shape the result.
References
- D. Andersson. 2026. Finding vulnerable code clones from known vulnerability cases: Seed construction, detector comparison, and manual assessment. MSc thesis, Linköping University. LIU-IDA/LITH-EX-A--26/065--SE. liu.diva-portal.org/smash/record.jsf?pid=diva2%3A2084577